Other chain and infrastructure vulnerabilities in disclosed reports
Wallets, node software, exchange infrastructure and chains outside the four major virtual machine families.
- Reports indexed
- 2
- Total paid
- $2k
- Critical
- 0
- Largest payout
- $2k
Not every crypto disclosure is a contract bug. Wallet key handling, transaction-signing UX that misrepresents what is being approved, node RPC exposure, and exchange-side account and withdrawal logic all sit here — and the payouts are frequently larger than contract findings because the blast radius is custodial.
This bucket also holds chains and runtimes outside the main four: UTXO chains, privacy chains, and purpose-built L1s whose failure modes do not map onto the EVM vocabulary.
Because the surface is heterogeneous, the vulnerability category filter is the more useful lens on these reports than the chain filter alone.
What reviewers look for
- Key material reachable from a lower-trust process or an unencrypted store
- Signing prompts that misrepresent the transaction being authorised
- Node RPC methods exposed without authentication
- Withdrawal and account-recovery logic on custodial infrastructure
- Consensus or mempool behaviour specific to a non-EVM runtime
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Docker Secret Disclosure via GitHub Actions Cache Poisoning
A GitHub Actions cache poisoning vulnerability was identified in the Hyperledger repository infrastructure. The flaw allowed unauthorized actors to modify shared build cache keys and execute arbitrary code within CI/CD pipeline steps. When downstream workflows restored the manipulated cache, sensitive Docker credentials stored in environment variables were exposed. This allowed attackers to extract critical pipeline secrets without requiring write permissions to the underlying repository.
Window.opener bug at www.coinbase.com
A web application link on www.coinbase.com opened external URLs using target="_blank" without setting the rel="noopener" or rel="noreferrer" security attributes. This allowed the newly opened destination window to access and manipulate the parent tab through the JavaScript window.opener reference. An attacker controlling the external target site could leverage this access to redirect the user's active Coinbase tab to a malicious external URL or phishing page. Coinbase rewarded the finding with a $100 bounty.