function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2
require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded
sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale");
reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED);
merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds
flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check
require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1)
assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor();
IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338)
- cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only
mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner);
uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000
[PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external {
prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy");
+ require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17
forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap)
function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2
require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded
sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale");
reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED);
merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds
flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check
require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1)
assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor();
IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338)
- cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only
mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner);
uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000
function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2
require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded
sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale");
reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED);
merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds
flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check
require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1)
assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor();
IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338)
- cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only
mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner);
uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000
[PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external {
prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy");
+ require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17
forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap)
function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2
require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded
sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale");
reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED);
merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds
flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check
require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1)
assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor();
IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338)
- cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only
mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner);
uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000
Bug bounty programs
Explore bounties
Each program shows its locked rulebook version, how it's funded, and how it has actually behaved. Median response times, SLA compliance and mediation reversals are computed from real case events.
- Total bounties available
- $0
- Paid to researchers
- $0
- Verified disclosures
- 0
- Researchers
- 0
Program
Max bounty
Payout assurance
Median response
Rules updated
No programs match these filters.