Abracadabra Money — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Abracadabra Money, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 17
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 17 closed, publicly disclosed Abracadabra Money reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Access control, Oracle manipulation, Front-running / MEV, Logic error, Integer overflow / underflow, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Access control findings disclosed against Abracadabra Money
- Oracle manipulation findings disclosed against Abracadabra Money
- Front-running / MEV findings disclosed against Abracadabra Money
- Logic error findings disclosed against Abracadabra Money
- Integer overflow / underflow findings disclosed against Abracadabra Money
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Abracadabra Money: Miscalculation in addLiquidity of Router results in unauthorized spending of tokens
The Abracadabra Money Router contains a calculation flaw in its liquidity provision function that causes users to inadvertently spend more tokens than intended. By front-running a user's addLiquidity transaction with a token donation, an attacker can manipulate the contract's reported balances, causing the Router's incorrect logic to demand larger token inputs from the victim. This results in the user providing more liquidity than specified in their original transaction, effectively unauthorized spending of their assets.
Abracadabra Money: MagicLpAggregator doesn't consider the dcimal of MagicLP
The Abracadabra `MagicLpAggregator` contains a precision error that incorrectly calculates the price of `MagicLP` tokens when the underlying base token does not use 18 decimals. The pricing logic normalizes token reserves to 18 decimals but fails to perform the same normalization for the LP token's total supply. This discrepancy leads to significantly inflated price outputs, which could be leveraged to manipulate collateral valuations in the protocol's lending cauldrons.
Abracadabra Money: Adjusting "_I_" will create a sandwich opportunity because of price changes
The MagicLP contract, inherited from the DODO Proactive Market Maker, allowed for public updates to critical pricing parameters through the setParameters function. Because these administrative calls were broadcast to the public mempool, MEV bots could front-run the transactions to perform sandwich attacks against the pool. This exploit allowed bots to extract value by trading against the price shift caused by the parameter change, ultimately draining value from liquidity providers.
Abracadabra Money: Staking contract is not able to support native USDB/WETH
The Abracadabra Money staking contract, LockingMultiRewards, was unable to account for native Blast rebasing tokens, such as USDB and WETH, when they were used as reward assets. Because the contract relied on static internal accounting to track rewards, it ignored the additional yield generated automatically by these tokens on the Blast network. As a result, this accrued yield remained inaccessible within the contract, preventing users from receiving their full potential earnings.
Abracadabra Money: Permanent loss of yield for stakers in reward pools due to precision loss.
The LockingMultiRewards contract in the Abracadabra Money protocol performs reward rate calculations using integer division before multiplication, leading to significant precision loss. Because the contract truncates remainders during the calculation of `rewardRate`, a portion of the reward tokens is effectively lost and cannot be distributed to stakers. For high-value assets such as WBTC, this systematic truncation results in material loss of funds across every notification cycle, negatively impacting all stakers.
Abracadabra Money: Less base tokens are transferred when selling quote tokens due to the precision loss that occurred in `_GeneralIntegrate()`
The Abracadabra Money `MagicLP` contract suffers from significant precision loss due to improper ordering of mathematical operations during price calculations. Specifically, the `_GeneralIntegrate` function performs chained divisions before multiplications, which results in truncated intermediate values and systemic under-calculation of base tokens during quote token sales. This flaw directly impacts the accuracy of the protocol's automated market maker logic, potentially leading to unfavorable execution for users or protocol imbalances. The issue was verified to cause a 27.5% discrepancy in output amounts under specific conditions.
All reports in this group
- Abracadabra Money: `LockingMultiRewards` contract on Blast does not configure gas yield nor token yield mode.Access control$0
- Abracadabra Money: Tokens yeild can not be set to claimable.Logic error$0
- Abracadabra Money: Missing Return Statement in `_getReserves` Function in `MagicLpAggregator` ContractOracle manipulation$0
- Abracadabra Money: Anyone making use of the MagicLP's TWAP to determine token prices will be exploitable.Oracle manipulation$0
- Abracadabra Money: `MagicLpAggregator` can be incompatible with potential integrators due to incorrect `latestRoundData` functionOracle manipulation$0
- Abracadabra Money: Oracle price can be manipulatedOracle manipulation$0
- Abracadabra Money: Users who deposited MIM and USDB tokens into BlastOnboarding may incur losses when the pool is created via bootstrapReentrancy$0
- Abracadabra Money: Attacker can amplify a rounding error in MagicLP to break the I invariant and cause malicious pricingReentrancy$0
- Abracadabra Money: MagicLpAggregator always returns lower than correct answer, leading to arbitrage lossOracle manipulation$0
- Abracadabra Money: User can grief bootstrap process by sending the cap amount of unlocked tokens to it.Access control$0
- Abracadabra Money: Pool Creation Failure Due to WETH Transfer Compatibility Issue on Some ChainsOracle manipulation$0