Malda security record
As of 10 Nov 2026, Malda has 1 audit report on Trustblock, by Sherlock, dated 14 Aug 2025. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits0· Audit competitions 1
Newest first
| Report | Security firm | Date | Scope | Critical findings | Source |
|---|---|---|---|---|---|
| Malda auditAudit competition | Security firm: Sherlock | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
Findings17
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 2 | 14 |
| Low | 0 | 0 | 0 |
HighRebalancer can steal funds from markets by sending to custom receiver through Everclear BridgeMalda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportMediumBlacklist can be completely bypassed on outHere endpoint in mTokenGatewayMalda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportMediumBridges don't support all of the listed assetsMalda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportMediumEverclearBridge does not pull tokens from the Rebalancer, causing all rebalancing operations to failMalda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportMediumIf Across Bridging fails, all funds intended for bridging will become lockedMalda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportMediumIncorrect transfer size validation after time window reset can lead to rebalancing DoSMalda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportMediumMigrator severily underestimates slippage by using underlying instead of sharesMalda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportMediumMixedPriceOracleV4.sol :: getUnderlyingPrice()/getPirce() will not work for some tokens because API3 and EO oracles return prices using different decimals, causing DOS scenario.Malda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportMediumRebalancer can drain market funds via excessive bridge feesMalda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportMediumRebalancer can send to unallowed destination chains through EverclearBridgeMalda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportShow 5 more
MediumThe rebalancing system is broken when everclear bridge contract is usedMalda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportMediumThere is no endpoint for triggering liquidateExternal from extension chain to be executed by proof forwarderMalda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportMediumUnenforced maxFee and ttl Parameters in sendMsg FunctionMalda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportMediumWrapAndSupply::wrapAndSupplyOnExtensionMarket preventes users from supplying on hostMalda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportMediumWrong direction of rounding in redeem may lead to drain if exchange rate grows largeMalda audit · Sherlock · 14 Aug 2025Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="malda"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us