What happened
Molt EVM, an experimental self-replicating ERC-20 protocol on Base, lost approximately $127,000 on March 7, 2026 after an attacker bypassed its spawner authorization and minted tokens without permission.
Molt EVM's onlySpawnerToken modifier did not ensure that the configured spawner address could be changed only by the owner. An attacker could replace the authorized spawner with a malicious contract and then use mintFromSpawner() to mint unbacked tokens.
Case & protocol details
Attack Timeline
The attacker deployed a malicious contract that satisfied the token's spawner call path, overwrote the legitimate spawner through the weak authorization boundary, called mintFromSpawner() to create large amounts of mEVM, and swapped the minted tokens for WETH through Aerodrome liquidity.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.