Move language vulnerabilities in disclosed bug bounty reports
Move's resource model makes several classic bug classes unrepresentable — and concentrates the remaining risk in capabilities and access rules.
- Reports indexed
- 23
- Total paid
- $180k
- Critical
- 0
- Largest payout
- $180k
Move was designed with digital assets as first-class linear resources: they cannot be copied or silently dropped, and the type system enforces it. That removes an entire family of double-spend and accounting bugs at the language level, which is why the disclosure volume here is thinner and skewed toward design rather than implementation.
What remains concentrates in capability handling. A capability is a transferable right, and a program that stores one carelessly, exposes it through a public function, or grants it during initialization without a corresponding revocation path has handed over the privilege it was protecting.
Aptos and Sui diverge enough in their object and ownership models that findings rarely transfer between them cleanly, so the reports here are worth reading with the specific runtime in mind.
What reviewers look for
- Capabilities exposed through public entry functions
- Resources stored under an address the module does not control
- Generic type parameters not constrained to expected abilities
- Object ownership transfers without an accompanying authorisation check
- Init-time privileges with no revocation path
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Unchecked arithmetic in Move coin split enables balance underflow
A custom coin-splitting helper in a Move-based decentralized exchange implemented unsafe u128 downcasting that bypassed native Move checked arithmetic. Combined with a stale balance check preceding an internal callback, an attacker could request a swap amount exceeding their actual balance. The resulting u128 subtraction underflow truncated upon downcasting into a valid u64 value, crediting the attacker with an artificially inflated balance that could subsequently be drained from the exchange.
PoolTogether: Resetting delegation will result in user funds being lost forever
The PoolTogether protocol contained a critical logic vulnerability in the TwabController that allowed users to permanently lose access to their funds. By passing an address(0) as a delegate target, users inadvertently triggered a transfer of their balance to the null address, which could not be recovered or withdrawn. The issue was reachable via standard user interaction with the delegation system and mattered because it resulted in an irreversible loss of capital for the affected user.
Superposition: Missing `lower<upper` check in `mint_position`
Superposition's concentrated liquidity DEX failed to enforce that lower tick bounds are strictly less than upper tick bounds inside `mint_position`. When `lower == upper`, the delta price calculation evaluates to zero token cost while allowing zero-cost liquidity positions to be initialized in storage. An attacker can create thousands of zero-cost positions that alter tick traversal during user swaps, drastically diluting/stealing fee distributions from legitimate liquidity providers.
Phi: Exposed `_removeCredIdPerAddress` & `_addCredIdPerAddress` allows anyone to cause issues to current holders as well as upcoming ones
The Phi protocol mistakenly exposed critical state-management functions publicly, failing to implement any access control. This oversight allowed any user to modify, add, or delete cred-related data for other addresses, leading to internal data corruption. Consequently, attackers could perform gas-griefing attacks or render core protocol features, such as buying and selling cred shares, completely unusable for targeted victims.
Munchables: Single plot can be occupied by multiple renters
The LandManager contract contains a logic flaw in the transferToUnoccupiedPlot function that fails to synchronize the token's internal state after a move. By failing to update the plotId field in the ToilerState struct, the contract continues to associate the token with its original plot despite marking it as vacated in the occupancy mapping. This discrepancy can be exploited to bypass system checks, leading to inaccurate reward calculations and the potential for unauthorized multiple-occupancy of plots.
Optimism: The LPP challenge period can cause malicious and freeloader claims to be uncounterable and can also cause freeloader claims to be abused to entrap honest challengers
The Optimism Fault Dispute Game mechanism suffered from an insufficient clock extension issue when handling large preimage proposals (LPPs). Attackers could force honest challengers into a situation where they needed to interact with the preimage oracle to counter a claim, but were left with insufficient time on their chess clock to complete the mandatory challenge period. This vulnerability allowed attackers to steal bonds from honest challengers by making their claims uncounterable within the allocated time constraints.
All reports in this group
- Olas: Changing VoteWeighting contract can result in lost staking incentivesFlash loan attack$0
- Panoptic: Removed liquidity can overflow when calling `SemiFungiblePositionManager.mintTokenizedPosition` functionReentrancy$0
- DYAD: Liquidation bonus logic is wrongOracle manipulation$0
- DYAD: No incentive to liquidate small positions could result in protocol going underwaterLogic error$0
- DYAD: Kerosene collateral is not being moved on liquidation, exposing liquidators to lossOracle manipulation$0
- DYAD: Inability to perform partial liquidations allows huge positions to accrue bad debt in the systemFlash loan attack$0
- Renzo: Deposits will always revert if the amount being deposited is less than the `bufferToFill` valueReentrancy$0
- Taiko: Taiko SGX Attestation - Improper validation in certchain decodingLogic error$0
- Salty.IO: Attacker Can Inflate LP Position Value To Create a Bad Debt LoanOracle manipulation$0
- Salty.IO: formPOL lacks slippage and deadline protectionOracle manipulation$0
- Collective: MaxHeap.sol: Already extracted tokenId may be extracted againLogic error$0
- NextGen: Auction payout goes to `AuctionDemo` contract owner, not the token ownerLogic error$0
- NextGen: Auction winner can prevent payments via `safeTransferFrom` callbackLogic error$0
- Open Dollar: Malicious users are able to bypass the Tax payment using making a Fake BasicActions ContractLogic error$0
- Wildcat Protocol: Lenders can escape the blacklisting of their accounts because they can move their MarketTokens to different accounts and gain the `WithdrawOnly` Role on any account they wantReentrancy$0
- Tapioca DAO: twAML::participate - reentrancy via _safeMint can be used to brick reward distributionReentrancy$0
- Maia DAO Ecosystem: An attacker can mint an arbitrary amount of `hToken` on `RootChain`Access control$0