The smart contract in Marginal v1 contains an unsafe downcast that allows an attacker to settle a large debt position for a negligible asset cost. This flaw represents an incorrect conversion between numeric types, enabling the manipulation of debt settlement logic and potentially draining or redirecting funds. The vulnerability compromises the integrity of the contract’s financial operations, allowing attackers to achieve large economic gains at minimal expense.

The vulnerability affects the Marginal Smart Contract, specifically version 1 of the contract. No additional version granularity is reported. The issue is tied directly to the smart contract code deployed by the Marginal Protocol team.

The CVSS score of 6.8 indicates moderate risk, while the EPSS score of less than 1% suggests a low likelihood that attackers have already leveraged this flaw in the wild. The vulnerability is not currently listed in CISA’s KEV catalog, implying no known active exploitation. The attack vector is inferred to be an on‑chain transaction that triggers the unsafe downcast during debt settlement, requiring only that an attacker crafts a transaction to the vulnerable contract.