bug-bounty622
facebook479
xss316
google174
microsoft120
rce102
apple72
csrf60
web355
account-takeover53
writeup51
exploit43
sqli41
dos36
ssrf34
cve33
cloudflare32
privilege-escalation29
defi28
malware27
node26
smart-contract-vulnerability25
idor25
subdomain-takeover24
clickjacking23
smart-contract23
ethereum23
access-control21
react21
vulnerability-disclosure21
reverse-engineering20
auth-bypass19
aws19
remote-code-execution18
lfi18
cloud17
docker17
cors17
oauth17
supply-chain17
race-condition17
info-disclosure16
browser14
authentication-bypass14
solidity14
phishing14
denial-of-service11
sql-injection11
delegatecall11
wordpress10
0
bug-bounty
A bug discovered in Fluidity's reward distribution system where improper state management in reward function ordering could enable double-claiming of rewards across different batch and manual reward invocations. The vulnerability stems from insufficient tracking of reward claims when multiple batchReward() and manualReward() transactions execute out of order in the mempool.
smart-contract
bug-bounty
ethereum
erc20
state-machine
double-spending
reward-distribution
signature-verification
aave
compound
defi
code-audit
edge-case
Fluidity
fUSDC
AAVE
Compound
Token.sol
WorkerConfig.sol
CompoundLiquidityProvider.sol
AaveV3LiquidityProvider.sol
0
4/10
A guide for Web3 protocol teams on evaluating and selecting smart contract auditors to assess the security of their code, which governs significant amounts of decentralized finance value.