Acala Network — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Acala Network, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 4
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 4 closed, publicly disclosed Acala Network reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Front-running / MEV, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Acala Network
- Front-running / MEV findings disclosed against Acala Network
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Acala Network: `Unbond_instant` removes incorrect amount of shares
Acala's earning/staking module lets users unbond bonded stake instantly in exchange for a fee. `unbond_instant` subtracts the fee from the amount and passes only the post-fee `final_amount` to `OnUnbonded::happened`, so the share accounting removes fewer shares than were registered during bonding. Over many calls, residual shares remain locked in the reward pool, continuing to accrue rewards to their owner while permanently distorting the share-to-token ratio for other bonders. Acala confirmed the finding and fixed it in PR #2735.
Acala Network: Early user can break pool via inflation attack due to no minimum liquidity check in the incentive contract
Acala's incentives pallet did not enforce a minimum liquidity floor on its incentive pool, allowing a depositor to drive the pool to a tiny share count. Because per-deposit reward inflation is computed as floor(deposit * total_reward / total_shares), truncation yields zero inflation whenever total_reward is smaller than total_shares, so a user can repeatedly deposit geometrically growing share amounts (2, 4, 8, ...) while the reward base never grows. Rewards distributed as total_reward * user_shares / total_shares then underpay earlier depositors, letting the attacker extract funds, a donation/inflation vector most potent at very low liquidity. The maintainer confirmed the issue, noting it is near-impossible to trigger in production since anyone can deposit before rewards accrue, and fixed it in open-web3-stack/open-runtime-module-library PR #991.
Acala Network: Storage can be bloated with low liquidity positions
Acala's Incentives module `deposit_dex_share` imposes no minimum deposit, so anyone can open DEX LP share positions worth a single token unit. Because the Substrate runtime charges fixed storage cost per map entry, an attacker can cheaply spawn many such positions in a coordinated effort, bloating chain storage and raising maintenance costs with a potential denial of service. A provided Rust test shows successive 1-unit deposits create discrete share records rather than coalescing. Acala maintainer xlc confirmed the finding and applied a minimum-deposit guard in an open-runtime-module-library pull request.
Acala Network: Incentive accumulation can be sandwiched with additional shares to gain advantage over long-term depositors
Acala's incentives pallet distributes a fixed reward amount each discrete accumulation period, split across whatever shares exist when accumulate_incentives runs via the on_initialize hook. Because DEX/Loans shares can be deposited just before accumulation and withdrawn immediately afterwards with no unbonding period, a user can temporarily post a large position to capture a disproportionate share of the per-period reward and crowd out honest long-term depositors. The PoC diff to the accumulation test shows the identical total reward is credited even when total shares are doubled, exposing the accounting flaw at the heart of the issue.