Aegis.im YUSD — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Aegis.im YUSD, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Aegis.im YUSD reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Aegis.im YUSD
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Aegis.im YUSD: Insolvency as `YUSD` will depeg overtime as the redemption fees are disbursed with no collaterals backing them.
In AegisMinting.approveRedeemRequest, the protocol computes the collateral to return to a redeeming user from the full requested yusdAmount, then separately strips an insurance-fund fee from that yusd amount before burning. The fee-denominated portion of the YUSD is left outstanding as a liability with no collateral backing it, so every approved redemption converts fully-backed YUSD into unbacked YUSD. Over time, as redemption fees accumulate (configurable up to 50%), the contract's collateral pool drains relative to outstanding YUSD, driving a depeg and eventual insolvency. The team acknowledged the issue but declined to fix it at this time.
Aegis.im YUSD: A whale adversary can grief the redeem functionality through redeem limit consumption
Aegis.im's YUSD minting contract enforces a per-period redeem cap by incrementing a cumulative counter each time a user creates a redeem request, but it never decrements that counter when a request is withdrawn or rejected. A whale holding a large YUSD balance can therefore consume the entire period's redeem allowance with signed redeem requests and then withdraw them after expiry without the counter resetting. This denies legitimate users the ability to request redemptions until the period rolls over, a griefing DoS that costs the attacker only temporary fund lockup plus gas. The issue was acknowledged by the team but not fixed at the time of disclosure.