Other protocol vulnerabilities in disclosed bug bounty reports

Staking, derivatives, insurance, identity, gaming and infrastructure findings that do not fit the primary protocol categories.

Reports indexed: 211
Total paid: $352k
Critical: 0
Largest payout: $350k

This group holds everything with a distinct economic design that the main categories do not cover: liquid staking and validator accounting, perpetuals and options with their own margin engines, insurance and coverage pools, identity and attestation systems, and on-chain games.

The findings are heterogeneous but the review discipline is the same — reconstruct the invariant, then find the input that breaks it — and several of the most instructive write-ups on the platform sit in this bucket precisely because the designs are unusual.

Filtering by vulnerability category is generally the better lens here than protocol type.

What reviewers look for

Custom margin or collateral engines with untested boundary behaviour
Staking and reward accounting under partial withdrawal or slashing
Coverage and claims logic reachable outside the intended lifecycle
Cross-protocol integrations trusting an external accounting value
Novel mechanisms without an established review checklist

Curated highlights

The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.

highGovernance attackEVM-Solidity$350k

Governance proposal executes arbitrary call via delegatecall module

A severe vulnerability in the governance timelock contract enabled proposal execution using DELEGATECALL without restricting the target address to a verified allowlist. Because the delegatecall target contract operated within the context of the timelock's storage without layout restrictions, a malicious proposal could overwrite key storage slots. An attacker leveraging flash loans or governance weight could pass a proposal that delegated to a custom contract, overwriting the timelock admin address in slot 0 to hijack governance authority and drain treasury funds.

DAO Treasurycode4renaJun 19, 2023Open

highLogic errorOther$2k

Docker Secret Disclosure via GitHub Actions Cache Poisoning

A GitHub Actions cache poisoning vulnerability was identified in the Hyperledger repository infrastructure. The flaw allowed unauthorized actors to modify shared build cache keys and execute arbitrary code within CI/CD pipeline steps. When downstream workflows restored the manipulated cache, sensitive Docker credentials stored in environment variables were exposed. This allowed attackers to extract critical pipeline secrets without requiring write permissions to the underlying repository.

hyperledgerhackeroneApr 20, 2024Open

mediumLogic errorOther$100

Window.opener bug at www.coinbase.com

A web application link on www.coinbase.com opened external URLs using target="_blank" without setting the rel="noopener" or rel="noreferrer" security attributes. This allowed the newly opened destination window to access and manipulate the parent tab through the JavaScript window.opener reference. An attacker controlling the external target site could leverage this access to redirect the user's active Coinbase tab to a malicious external URL or phishing page. Coinbase rewarded the finding with a $100 bounty.

coinbasehackeroneNov 28, 2016Open

mediumLogic errorEVM-Solidity$0

Putty: Put option sellers can prevent exercise by specifying zero amounts, or non-existant tokens

The Putty protocol contained a logic vulnerability where option sellers could create orders that were impossible to exercise, effectively stealing the buyer's premium. By specifying either a zero-amount asset or a non-existent token address, a seller could force the contract to revert whenever a buyer attempted to exercise their option. This resulted in a denial-of-service (DoS) condition that rendered the buyer's position worthless. The issue was fixed by updating the asset transfer logic to skip zero-amount transfers instead of reverting.

Puttycode4renaAug 7, 2026Open

highLogic errorEVM-Solidity$0

Putty: Fee is being deducted when Put is expired and not when it is exercised.

The Putty V2 contract contained a logic error in its fee application mechanism for put options, causing fees to be charged incorrectly upon expiration rather than exercise. This flaw led to an unintended loss of assets for users holding expired put options while simultaneously failing to collect fees on legitimately exercised options. The protocol was vulnerable because the withdrawal function erroneously prioritized charging fees based on expired status rather than exercise status, negatively impacting both user capital and protocol revenue.

Puttycode4renaAug 7, 2026Open

mediumFront-running / MEVEVM-Solidity$0

Putty: Order cancellation is prone to frontrunning and is dependent on a centralized database

Putty's order cancellation mechanism suffered from critical dependencies on centralized infrastructure and exposure to frontrunning. Because cancellations required on-chain transactions with specific order data, users could not cancel without either interacting with a centralized database or risking MEV-based frontrunning. This design created a significant risk where a centralized server outage could prevent users from invalidating orders, leaving their funds vulnerable to exploitation by parties holding mirrored order data.

Puttycode4renaAug 7, 2026Open

All reports in this group

Vulnerability classes seen in this protocol type

Reentrancy Oracle manipulation Flash loan attack Access control Integer overflow / underflow Signature replay Front-running / MEV Bridge exploit Logic error Governance attack

Related protocol type pages

DEX Lending Bridge Oracle NFT Stablecoin