{
  "id": 14224031,
  "title": "When the Smart Contract Works, but the Payment Is Wrong: A Collusion Attack in MealForward (Part 1)",
  "url": "https://urgent.news/2026/10/13/when-the-smart-contract-works-but-the-payment-is-wrong-a-collusion",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-13T15:02:23.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/mililin_f4f9ec3965934d912/when-the-smart-contract-works-but-the-payment-is-wrong-a-collusion-attack-in-mealforward-part-1-4pj7"
  },
  "original_language": "en",
  "account": "Recently, I have been investigating MealForward, a community meal voucher system developed for the Monad Hackathon. The project functions as follows: donors provide funds to an on-chain escrow contract, authorized issuers distribute meal vouchers, and consumers redeem those vouchers at participating restaurants using temporary QR codes. Following a restaurant's confirmation that a meal has been served, the escrow contract transfers the corresponding payment to the restaurant. While examining the smart contracts, a peculiar query emerged: What occurs if a smart contract performs precisely as intended but still results in the incorrect payment? This inquiry broadened our focus beyond Solidity-level security to encompass collusion attacks, on-chain/off-chain consistency, EIP-712 authorization, delayed settlement, and trust assumptions. Here's the progression of our investigation.",
  "summary": "Recently, I've been working on MealForward , a community meal voucher project built for the Monad Hackathon. The idea is straightforward: donors deposit funds into an on-chain escrow contract, authorized issuers distribute meal vouchers, and recipients redeem those vouchers at participating restaurants using temporary QR codes. Once a restaurant confirms a meal has been delivered, the escrow…",
  "key_points": [
    "MealForward system distributes vouchers via escrow contract",
    "Incorrect payment possible if smart contract functions correctly",
    "Investigation explores collusion attacks and trust assumptions"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}