CoinBuggie

DEX vulnerabilities in disclosed bug bounty reports

Automated market makers hold liquidity and publish a price, which makes them both a target and the instrument used against other protocols.

Reports indexed
382
Total paid
$1.2M
Critical
1
Largest payout
$900k

A DEX is an invariant plus a pool of assets, and almost every finding is a way to push the invariant somewhere it was not meant to go: rounding that favours the swapper, fee accrual that can be zeroed, callback hooks in concentrated-liquidity designs that re-enter mid-swap, and router paths that trust a user-supplied token list.

Just as often the DEX is not the victim. Its spot price is read by a lending market, its LP token is valued by a vault, and a pool with thin liquidity becomes the cheapest lever available against a much larger protocol.

Reports here pair naturally with the price manipulation and oracle manipulation categories.

What reviewers look for

  • Invariant checks skipped or performed before external interaction
  • Router paths accepting arbitrary intermediate tokens
  • Swap callbacks re-entering pool state
  • Rounding direction favouring the caller
  • Pool depth low enough to move within a single transaction

Curated highlights

The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.

criticalOracle manipulationEVM-Solidity$900k

Spot TWAP oracle manipulated via single-block flash loan

A perpetual derivatives protocol relied on a Uniswap V3 TWAP oracle whose pool observation cardinality was capped at 12, severely reducing its intended 30-second time-weighted average window. An attacker executed a single-block flash loan to heavily distort the underlying spot price without triggering any secondary price feed validation. This allowed the attacker to open oversized leveraged positions at an artificial mark price and force liquidations against counterparties in a single atomic transaction.

Perp DEXsherlockAug 2, 2023Open
highInteger overflow/underflowMove$180k

Unchecked arithmetic in Move coin split enables balance underflow

A custom coin-splitting helper in a Move-based decentralized exchange implemented unsafe u128 downcasting that bypassed native Move checked arithmetic. Combined with a stale balance check preceding an internal callback, an attacker could request a swap amount exceeding their actual balance. The resulting u128 subtraction underflow truncated upon downcasting into a valid u64 value, crediting the attacker with an artificially inflated balance that could subsequently be drained from the exchange.

Move DEXhatsSep 27, 2023Open
mediumFlash loan attackEVM-Solidity$75k

Flash-loanable veToken balance inflates emissions gauge weights

A design flaw in the gauge voting system allowed real-time veToken balance checks instead of utilizing checkpointed block or epoch snapshots. An attacker could execute a flash loan to acquire governance tokens, temporarily lock them to generate veToken voting power, vote to direct reward emissions toward their target gauge, and release the lock to repay the flash loan within the same block. This enabled uncollateralized, risk-free manipulation of protocol reward distributions.

Gauge Emissionscode4renaFeb 2, 2024Open
lowLogic errorEVM-Solidity$9k

Oracle-free AMM invariant rounding allows slow drain

A directional rounding flaw in the Newton-Raphson solver for a StableSwap invariant enabled subtle value extraction during token exchanges. When computing invariant values and target balances, both routines rounded down, yielding an extra wei of token output to the user on specific balance ratios. On low-fee Layer 2 blockchains, an automated script could execute high-frequency minimal swaps to steadily extract pool reserves over time.

Stableswap PoolhatsApr 9, 2024Open
highLogic errorEVM-Solidity$0

Good Entry: When price is within position's range, `deposit` at TokenisableRange can cause loss of funds

Good Entry's TokenisableRange.deposit charges a portion of a user's fresh deposit as protocol fees whenever the pool's live slot0 spot price sits inside the position's tick range, splitting the amount using LiquidityAmounts.getAmountsForLiquidity at that transient price. Because the split is computed from the momentary spot price, a price move between transaction submission and execution — whether from market fluctuation or a deliberate frontrunner — can push the price out of range, which returns a zero token amount for one leg and converts that leg's entire deposit into fees. The follow-on increaseLiquidity call still succeeds because the per-leg 95% minimum is satisfied by the discounted remaining amount, so the depositor loses a full token leg to fees instead of gaining position liquidity. The sponsor initially disputed the report, then confirmed it and removed the fee-clawing mechanism entirely in PR#4.

Good Entrycode4renaAug 7, 2026Open
highLogic errorEVM-Solidity$0

Good Entry: V3Proxy swapTokensForExactETH does not send back to the caller the unused input tokens

Good Entry's V3Proxy wraps the Uniswap V3 router, exposing a swapTokensForExactETH entry point that pulls a caller-specified maximum amountInMax of an input ERC-20 but only pays the router the exact input consumed by the swap. Because the function never returns the delta between amountInMax and the actually-consumed amount to the caller, every user who specifies an input allowance larger than the swap needs permanently loses that excess, with the funds left stranded in the V3Proxy contract. The flaw is confirmed by the sponsor and was fixed in a follow-up PR that refunds the unused balance; a reproducible Foundry PoC demonstrates the missing refund via a failing balance assertion. Economically this amounts to a systematic overcharge equivalent to locked funds for the protocol's users, which is why it is rated high severity.

Good Entrycode4renaAug 7, 2026Open

All reports in this group

Vulnerability classes seen in this protocol type

Reentrancy Oracle manipulation Flash loan attack Access control Integer overflow / underflow Front-running / MEV Price manipulation Logic error Governance attack

Related protocol type pages

Lending Bridge Oracle NFT Stablecoin Other protocols