Lending protocol vulnerabilities in disclosed bug bounty reports

Lending markets depend on external prices and on liquidation working under stress — most findings target one or the other.

Reports indexed: 949
Total paid: $2.0M
Critical: 2
Largest payout: $1.2M

A lending market is solvent as long as collateral is valued correctly and bad positions can be closed. Findings therefore concentrate on valuation — the oracle path, the collateral factor, the treatment of exotic or illiquid assets — and on the liquidation engine that has to function precisely when the network is congested and prices are moving.

Interest accrual is the quieter surface: markets where accrual can be skipped, front-run, or forced to round to zero, and where the index used to compute debt diverges from the actual outstanding balance.

Because lending markets consume prices rather than produce them, they are the most common victim protocol in oracle and flash loan reports.

What reviewers look for

Collateral valuation reachable through a manipulable price path
Liquidation incentives insufficient under congestion or extreme moves
Interest accrual skippable or exploitable through call ordering
Debt accounting that can round to zero for small positions
Newly listed or illiquid collateral assets with generic risk parameters

Curated highlights

The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.

criticalReentrancyEVM-Solidity$1.2M

Read-only reentrancy in LP price oracle drains lending market

A lending market relied on a liquidity pool's raw virtual price function to value LP tokens deposited as collateral. During a liquidity removal operation, ETH transfers to the caller occurred before internal balance and supply states were reconciled, allowing an execution callback while state was inconsistent. An attacker used this callback to fetch an artificially inflated virtual price, enabling them to over-borrow against their collateral and drain the protocol's reserves in a single transaction.

Curve-style Lending Marketcode4renaApr 11, 2023Open

criticalAccess controlSolana-Rust$600k

Missing owner check on Solana instruction lets attacker drain vault

A missing program ownership check in a Solana yield vault protocol allowed unauthorized account spoofing during withdrawal processing. Because the instruction handler accepted an unchecked account and verified only a discriminator byte rather than validating account ownership, an attacker could supply a custom state account with manipulated fields. The protocol trusted the forged state data and generated a Program Derived Address (PDA) signature to execute a token transfer, enabling complete draining of the protocol's vault funds.

Solana Yield VaultimmunefiNov 3, 2022Open

highLogic errorEVM-Solidity$120k

Rounding direction lets attacker mint shares for free on first deposit

A classic ERC-4626 share inflation vulnerability enabled an attacker to steal deposits from initial vault users. By depositing a single wei of assets to receive one share and then transferring a large amount of assets directly to the vault contract, the exchange rate ratio was severely skewed. Subsequent deposits from victims rounded down to zero minted shares while forfeiting their underlying tokens, allowing the attacker to redeem their single share for the entire vault balance.

ERC-4626 VaultcantinaJan 15, 2024Open

mediumFront-running / MEVEVM-Solidity$45k

Sandwichable liquidation bonus enables MEV extraction from borrowers

A lending protocol's liquidation routine executed collateral swaps through an AMM router with zero slippage protection (`amountOutMin` set to zero) while relying on spot prices for bonus calculations. Mempool searchers could sandwich pending liquidation transactions by driving up local pool prices beforehand, forcing the swap to settle at severely degraded exchange rates. This allowed MEV bots to siphon excess value from the liquidated borrower's remaining collateral pool.

Money Marketcode4renaMar 8, 2024Open

mediumReentrancyEVM-Solidity$0

PoolTogether: Unintended or malicious use of prize winners' hooks

In PoolTogether v5, the Vault contract allows prize winners to configure arbitrary hooks via the setHooks function. During the prize claiming process, the contract executes these user-defined hooks prior to and after prize distribution. Because the hook calls lack gas consumption caps and state-change restrictions, a user can configure a malicious hook that conducts unconstrained external operations, griefs claimers paying for transaction gas, or causes claiming transactions to revert. This results in potential gas exhaustion and denial of service for third-party prize claimers.

PoolTogethercode4renaAug 7, 2026Open

mediumLogic errorEVM-Solidity$0

Union Finance: `UnionToken` should check whitelist on `from`?

Union Finance's UnionToken enforces its whitelist guest list inside the OpenZeppelin ERC20 _beforeTokenTransfer hook, but validates isWhitelisted(msg.sender) rather than isWhitelisted(from). Because the hook fires on both transfer and transferFrom, a single whitelisted contract or relayer can be granted an allowance and move tokens out of any non-whitelisted account as long as the operator itself passes the whitelist. This effectively sidesteps the guest list entirely for any token holder who establishes an allowance. The sponsor confirmed the issue and the judge upheld it as medium severity, directing that the check be applied to the from address.

Union Financecode4renaAug 7, 2026Open

All reports in this group

Vulnerability classes seen in this protocol type

Reentrancy Oracle manipulation Flash loan attack Access control Integer overflow / underflow Signature replay Front-running / MEV Bridge exploit Price manipulation Logic error Governance attack

Related protocol type pages

DEX Bridge Oracle NFT Stablecoin Other protocols