Malda audit
Audit competition · firm’s term: public best efforts audit contest
Sherlock reviewed Malda (Malda audit) on 14 Aug 2025: 17 findings, 0 critical; 15 marked fixed, 2 acknowledged.
Findings17
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 2 | 14 |
| Low | 0 | 0 | 0 |
HighRebalancer can steal funds from markets by sending to custom receiver through Everclear BridgeFixed
The report gives no description here.
MediumBlacklist can be completely bypassed on outHere endpoint in mTokenGatewayFixed
The report gives no description here.
MediumBridges don't support all of the listed assetsFixed
The report gives no description here.
MediumEverclearBridge does not pull tokens from the Rebalancer, causing all rebalancing operations to failFixed
The report gives no description here.
MediumIf Across Bridging fails, all funds intended for bridging will become lockedFixed
The report gives no description here.
MediumIncorrect transfer size validation after time window reset can lead to rebalancing DoSFixed
The report gives no description here.
MediumMigrator severily underestimates slippage by using underlying instead of sharesFixed
The report gives no description here.
MediumMixedPriceOracleV4.sol :: getUnderlyingPrice()/getPirce() will not work for some tokens because API3 and EO oracles return prices using different decimals, causing DOS scenario.Fixed
The report gives no description here.
MediumRebalancer can drain market funds via excessive bridge feesFixed
The report gives no description here.
MediumRebalancer can send to unallowed destination chains through EverclearBridgeFixed
The report gives no description here.
Show 5 more
MediumThe rebalancing system is broken when everclear bridge contract is usedFixed
The report gives no description here.
MediumThere is no endpoint for triggering liquidateExternal from extension chain to be executed by proof forwarderFixed
The report gives no description here.
MediumUnenforced maxFee and ttl Parameters in sendMsg FunctionFixed
The report gives no description here.
MediumWrapAndSupply::wrapAndSupplyOnExtensionMarket preventes users from supplying on hostFixed
The report gives no description here.
MediumWrong direction of rounding in redeem may lead to drain if exchange rate grows largeFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Malda’s security record
MaldaSecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us