What happened
Malda's Mendi-to-Malda migrator on Linea accepted a fake Mendi Comptroller supplied by an attacker. This allowed the attacker to create a fraudulent Malda position and withdraw assets. Malda said the exploit was isolated to the migrator and paused the protocol.
Technical root cause
Migrator.sol accepted a caller-supplied Comptroller without enforcing the trusted Mendi address. Trusting the malicious replacement allowed an unbacked position to be created and redeemed.
How it happened
- The attacker deployed a malicious contract posing as the Mendi Comptroller.
- The migrator accepted that address and created a synthetic position without a genuine Mendi position backing it.
- The attacker withdrew assets, swapped them to ETH and bridged them to Ethereum.
- Malda paused the protocol and disabled the migrator through its configuration.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
