# theft of system profit

Malt's above-peg stabilize profit could be sandwiched: flash-borrow Malt, dump it, call stabilize to push price down, rebuy cheap, repay loan.

- Payout: Audit contest
- Severity: medium
- Program: Malt Finance
- Found by: danb
- Disclosed: 2022-02-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-malt-findings/issues/56
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-16
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:oracle-manipulation

**Target:** Malt stablecoin AMM / stabilize mechanism
**Root cause:** Stabilize above peg is permissionless and callable by anyone, so the profit intended for LPs/investors can be captured by an attacker who first moves the price with a large swap.
**Steps:**
1. Price of Malt is 1.2 DAI (above peg).
2. Flash loan a large amount of Malt.
3. Sell the Malt for DAI, pushing price down to ~1.1 DAI.
4. Call `stabilize` to lower the price further to 1 DAI.
5. Buy Malt back with the DAI at the lower price.
6. Repay flash loan and keep the difference.
**How found:** Warden reasoned that system profit from stabilize above peg should belong to Malt holders, so any permissionless path letting a non-holder capture that profit is a flaw; constructed a sandwich around the stabilize call.
**Exploitation:** Attacker flash-borrows Malt, dumps it to depress price, invokes stabilize to push price to peg, rebuys Malt cheaply, repays loan, and pockets the spread that would otherwise accrue to LPs/investors.
**Insight:** When a protocol's price-stabilization or profit-realization function is permissionless, check whether an attacker can move the price first, trigger the stabilizer, then trade back — the stabilizer becomes a free profit source for sandwich bots.