A returndata bomb vulnerability in RAI's LiquidationEngine allows an attacker to deploy a malicious whitelisted savior contract that reverts with massive data, exhausting gas during the catch clause and rendering positions unliquidatable—causing protocol bad debt. The researcher disputes Immunefi's downgrade from Medium to None severity, arguing governance whitelisting cannot detect this emergent EVM interaction vulnerability.
A portfolio page showcasing multiple critical smart contract vulnerability disclosures across DeFi protocols (88mph, Polygon, KeeperDAO, Alchemix, Ondo Finance) and bug bounty wins totaling over $6.5M in rescued funds, with brief technical descriptions of UUPS proxy exploits, access control flaws, and token theft vulnerabilities.
Portfolio page showcasing multiple critical smart contract vulnerabilities disclosed across DeFi/NFT protocols, including access control flaws, uninitialized UUPS proxies enabling arbitrary delegatecalls, and broken token transfer functions. Author details bounty payouts and rescued funds across 88mph, Polygon, KeeperDAO, and other projects, with limited technical depth on each vulnerability.
A missing access control and unchecked state transition vulnerability in Alchemist's TimelockConfig.confirmChange() function allows any attacker to set arbitrary configuration parameters (including admin and recipient addresses) to zero without initiating the required first step, permanently bricking critical DeFi functions like token minting for staking rewards.
A reentrancy vulnerability in TectonicStakingPoolV3 allows attackers to mint xTonic tokens for free by injecting a malicious token into swap paths during performConversionForTokens() calls, enabling theft of over $2.5M with minimal capital ($23K TONIC). The attack exploits unwhitelisted intermediate swap path tokens to gain execution control and stake during balance calculations.
A vulnerability in Tranchess's ShareStaking contract allows attackers to drain user funds by exploiting a skipped `_checkpoint()` call during rebalance events, causing a mismatch between token total supplies and actual contract balances. The attack leverages the contract's gas optimization technique to manipulate `spareAmount` calculations and steal staked tokens.
A high-risk vulnerability in Ondo Finance's TrancheToken smart contract allowed attackers to destroy the uninitialized implementation contract via selfdestruct, causing all proxy contracts to no-op and potentially draining $50m from UniswapStrategy contracts if a minting flag were enabled. The bug was patched immediately after disclosure with no user funds at risk.
This article collection documents smart contract vulnerabilities discovered in Web3 projects, including Betverse's public function visibility flaw enabling token theft and Ocean Protocol's unprotected ownerWithdraw function allowing unauthorized fund transfers. These medium to critical severity bugs highlight improper access control in Solidity smart contracts.
A critical vulnerability in the Betverse ICO Token contract's transferTokenToLockedAddresses() function was caused by incorrectly marking it as public instead of internal, allowing attackers to steal BToken by repeatedly transferring funds to their addresses. The article documents this access control misconfiguration discovered during security research on the Immunefi platform.
An analysis of how bug-fix attempts in the RAI protocol's debt auctions introduced critical vulnerabilities while addressing low-severity issues, alongside technical exploration of EVM bit masking operations and assembly-level smart contract optimization techniques.
A low-severity bug in the TypedMemView library's isValid function was caused by incorrect use of the bitwise NOT instruction instead of the ISZERO instruction in Yul assembly, causing the function to always return true regardless of whether memory bounds were valid. The bug was responsibly disclosed to Nomad, patched by replacing 'not' with 'iszero', and publicly documented.
Brahma.Fi's L2 position handler contains a sign confusion bug in positionInWantToken() that miscalculates position value when the account is underwater, treating negative account values as positive funds. This leads to incorrect share calculations during deposits/withdrawals, fee overcharges, and potential protocol insolvency through user exploitation.
Morpho Finance's PositionsManager implementation contract can be directly called (bypassing proxy) with arbitrary state mutation via unvalidated delegatecall, potentially allowing attackers to trigger selfdestruct and shut down the system. The vulnerability stems from uninitialized storage pointers and lack of access controls on dangerous delegatecall operations.
A critical bug in Thena's reward claiming mechanism prevents veNFT holders from claiming rewards after their lock period expires due to an improper expiry check in the deposit_for function. The vulnerability freezes user rewards and was missed by CodeArena auditors despite affecting forked code from previously audited protocols.