MALT (Polygon): ~$72k after rebalanceHook counts treasury DAI as input
03 Oct 2026: SlowMist TI flagged MALT on Polygon for about $72k lost when swap recorded caller input and pre-swap reserves, then an external rebalanceHook pulled DAI from the protocol Capital Source into the pool before output transfer.
Later checks treated that treasury-funded DAI as if the caller had supplied it, so tiny input withdrew disproportionate MALT. Firm alerts published attacker, victim, and contract identifiers plus a Polygon tx.
Separate protocol from GoldPesa, same rebalance-capital class. Research snapshot from CoinEdition and AiCoin / SlowMist TI flashes.
369 take
If a hook can inject treasury tokens mid-swap and the invariant still credits the caller, the pool pays the wrong party.
Pulse lesson: any external rebalance during swap needs its own accounting bucket, not the caller's input line.
Sources