MAYAChain Hit by $11M Exploit After Attacker Stole $1.36M in Assets

A recent exploit on MAYAChain's liquidity network led to an estimated $11 million in pool damage, up from an initial $1.36 million in stolen assets. The attacker exploited a vulnerability in the system, which allowed them to create a false accounting entry that became withdrawable.

According to independent researcher Vini Barbosa, the attack began with a MsgDeposit transaction containing 23 messages, one of which overwrote earlier ObservedTxVoter state and activated theft-detection logic. This logic calculated a subsidy for a near-empty ARB pool without bounding it to the pool's depth, resulting in an inflated balance of roughly 49.45 million CACAO.

The attacker then added a negligible amount of liquidity to the distorted pool and received about 99.93% of its ownership units, enabling a withdrawal of roughly 48.87 million CACAO. The token fell from around $0.115 to $0.013 during the incident, an 88.7% drop.