A high-severity griefing vulnerability in Charged Particles' NFT marketplace allowed an attacker to lock Protons (NFTs) by setting a malicious ransom contract as the royalties receiver, forcing buyers to pay bribes to complete transactions. The vulnerability was fixed after a $5,000 USDC bounty was awarded.
A critical ERC-20 token implementation bug in Redacted Cartel's wxBTRFLY contract allowed attackers to reassign user allowances to themselves via a faulty transferFrom function, risking $6 million in funds. The vulnerability was fixed by replacing the custom implementation with OpenZeppelin's battle-tested ERC-20, and the researcher received a $560,000 bounty.
A critical logic error in Yield Protocol's strategy contract allowed attackers to drain pool tokens by inflating the balance calculation through direct token transfers; the vulnerability was responsibly disclosed by whitehat Paludo0x, who received a $95,000 USDC bounty after the $950k at-risk vulnerability was patched by modifying the burn function to use cached pool values instead of live balance checks.