# User can bypass Recovery Mode via UniswapHandler to buy Malt

Whitelisted UniswapHandler lets users swap DAI to Malt during Recovery Mode, bypassing the buy-block and enabling risk-free MEV via addLiquidity.

- Payout: Audit contest
- Severity: medium
- Program: Malt Finance
- Found by: gzeon
- Disclosed: 2022-02-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-malt-findings/issues/325
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-29
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained vuln:access-control vuln:business-logic

**Target:** UniswapHandler / Malt swap and liquidity contracts
**Root cause:** UniswapHandler is whitelisted so it can receive Malt even in Recovery Mode, and addLiquidity is callable by anyone, letting users acquire Malt at discount by routing through the handler.
**Steps:**
1. Call `swapExactTokensForTokens(amountDai, 0, [dai, malt], uniswapHandler, deadline)` to swap DAI→Malt with recipient set to the whitelisted UniswapHandler.
2. Send matching amount of DAI to UniswapHandler.
3. Call `addLiquidity()` to receive LP tokens.
4. Call `removeLiquidity()` to redeem DAI and Malt (blocked in practice by #323).
**How found:** Warden read the protocol docs stating UniswapHandler is whitelisted in recovery mode, then reasoned that routing a swap through the whitelisted handler bypasses the buy-block check.
**Exploitation:** Attacker swaps DAI to Malt with UniswapHandler as recipient (whitelisted, so transfer succeeds during Recovery Mode), then adds liquidity at the discounted price, capturing MEV from the buy-block bypass while risking impermanent loss if Malt returns to peg.
**Insight:** When a protocol whitelists a contract to bypass a global restriction, check whether that whitelisted contract's other entry points (addLiquidity, receive, etc.) can be abused to smuggle the restricted action through it.