EVM and Solidity vulnerabilities in disclosed bug bounty reports

The EVM is where most disclosed value has been lost and most disclosed bounty has been paid. Its execution model — synchronous external calls, a shared global state, and `delegatecall` proxies layered over immutable code — produces a specific set of recurring failures that the rest of the industry now names after it.

Solidity-specific surface matters here: storage collisions between proxy and implementation, initializer sequencing on upgradeable contracts, `delegatecall` context confusion, gas-dependent behaviour in `transfer` versus `call`, and the long tail of ERC-20 tokens that do not return a boolean, that charge transfer fees, or that rebase.

Reports across every category in the taxonomy land here, so the EVM pages are best read alongside a category filter rather than end to end.