Allora — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Allora, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 41
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 41 closed, publicly disclosed Allora reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Access control, across Cosmos-SDK. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Allora
- Access control findings disclosed against Allora
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Allora: The SelectTopNWorkerNonces function lacks a sorting algorithm internally.
Allora's inference-synthesis keeper exposes SelectTopNWorkerNonces, which returns the first N entries of the worker-nonces array rather than the N with the highest block-height nonces because it never sorts its input. The function is invoked from requestTopicWorkers after filtering nonces to the current epoch but before any ordering step, so it can request inferences from stale or offline workers instead of the most recent ones. This degrades the quality and availability of the inferences the chain synthesizes. The project confirmed the bug and fixed it by adding a SortByBlockHeight call inside the function.
Allora: `GenerateForecastScores` acidentally updates inferences scores
Allora's rewards module computes worker payouts from recent per-topic, per-block scores. In the GenerateForecastScores path, when a topic's network-losses bundle contains exactly one forecaster for a block, the code writes a zero-valued placeholder into the worker's inference-score slot via InsertWorkerInferenceScore instead of updating the forecast slot. Because GetWorkersRewardFractions derives reward fractions from these stored scores, the wrong insertion corrupts internal accounting and skews payouts up or down. The single-forecaster condition recurs frequently since forecasts are recorded per topic per block across many topics on roughly a five-second block time. The protocol team confirmed the issue and fixed it with a one-line change to InsertWorkerForecastScore in pull request #466.
Allora: math miscalculation artificially deflates scores
Allora's GetConsensusScore reward-scoring routine computes a reputer's score as the reciprocal of (distance/consensusNorm + tolerance). An asymmetry in the routine deflates scores: in the loop that builds the numerator distance, any consensusLosses entry equal to zero is replaced with epsilon, but the denominator consensusNorm is precomputed from the original vector containing the zero. Because the numerator grows while the denominator does not, the ratio (and therefore the resulting reciprocal score) is pushed lower than the intended math. The impact is a rare but real under-crediting of affected reputers' reward shares whenever a consensusLosses value is exactly zero. The protocol team acknowledged and fixed the issue in PR #507 by counting the epsilon substitution in the denominator as well.
Allora: Silent Failure in MustNewDecFromString Can Lead to Node Crashes
Allora's node operator software converts string-valued inference responses into decimals via alloraMath.MustNewDecFromString in the AlloraExecutor's ExecuteFunction method. That helper panics on malformed input rather than returning a catchable error, and the surrounding code has no panic recovery, so an attacker supplying non-decimal strings for inferer, forecaster, or attributed values can trigger an unrecovered panic that crashes the node. The result is a denial-of-service against node availability. The protocol acknowledged the finding and the recommended fix replaces the Must* helper with the error-returning variant and propagates the error.
Allora: Topics wont activate even with a sufficient stake
Allora activates a topic only when its EMA-smoothed stake weight clears the MinTopicWeight parameter at deposit time. Because a fresh stake is blended with the historical EMA value rather than counted at full weight, a single large deposit can leave the topic's EMA value below threshold even when its raw weight exceeds it. The block-end EndBlocker routine only deactivates underweight topics and never activates newly eligible ones, so the topic remains permanently deactivated despite having sufficient staked weight. The finding affects topic activation gating rather than user funds, and was confirmed by the team and fixed in a follow-up pull request.
Allora: Missing highestVotingPower Update in argmaxBlockByStake Resulting in Incorrect Block Selection
Allora's argmaxBlockByStake helper selects the block height carrying the most cumulative staked voting power among candidate blocks voted on by reputers. The function's comparison logic updates the stored front-runner block when a higher-power block is found but never updates the highestVotingPower threshold, so every subsequent block with nonzero stake wins the comparison regardless of its actual power. Because the returned block height feeds downstream consensus-facing processing that trusts the reputer-stake aggregation, the flaw yields arbitrary rather than genuinely strongest block selection and can misdirect stake handling and derived decisions. The protocol acknowledged and remediated the defect in PR #141 by updating the threshold and guarding stake lookups.
All reports in this group
- Allora: Standard deviation calculation is biasedLogic error$0
- Allora: The formula for forecast normalization differs from the one in the whitepaper.Logic error$0
- Allora: Mint and Emissions modules register errors with an error code of 1Logic error$0
- Allora: incorrect condition for the iterative update of Equation 34Logic error$0
- Allora: Malicious peer can cause a syncing node to panic during blocksyncLogic error$0
- Allora: SetDelegateStakePlacement error is not handled in RewardDelegateStakeLogic error$0
- Allora: Funding amount is accounted twice leading to activating topic before reaching the global minimumLogic error$0
- Allora: `msg_server_stake::AddStake` calculates the weight incorrectly resulting in incorrect activation of a topicLogic error$0
- Allora: Treasury cap restriction will not hold and one block per month will be compromisedLogic error$0
- Allora: The worker and reputer's payload may be tampered due to lack of check for the pubkey's ownershipLogic error$0
- Allora: The malicious node may not execute the http requestLogic error$0
- Allora: If old coefficient is bigger than the new one then the reputer has it's coeff reduced more than it shouldLogic error$0
- Allora: SafeApplyFuncOnAllActiveEpochEndingTopics processes two more pages than the desired max topic pageLogic error$0
- Allora: emissions/keeper/GetIdsOfActiveTopics may always return empty array []Logic error$0
- Allora: Anyone can overwrite Reputer and Worker info attached to a LibP2PKeyLogic error$0
- Allora: Not appropriate Inferences will be used when calculating the forecastLogic error$0
- Allora: logic bug in this IBC middleware code related to packet handling.Logic error$0
- Allora: Potential race conditions due to usage of ````sdk.Context```` in concurrent goroutinesLogic error$0
- Allora: `AlloraPendingRewardForDelegator` module account could have insufficient rewards due to truncationLogic error$0
- Allora: Broken invariant : the sum of all (delegateRewardsPerShare * delegated stakeLogic error$0
- Allora: Lack of Authentication in OnRecvPacketAccess control$0
- Allora: SendDataWithRetry doesn't work properly(Retries will not happen)Logic error$0
- Allora: Incomplete Zero-Height Genesis Preparation in Allora NetworkLogic error$0
- Allora: Adversary can arbitrarily trigger a chain halt by sending `MsgRemove{Delegate}Stake` with negative amountLogic error$0
- Allora: RemoveDelegateStake silently handles the error when checking for existing removalsLogic error$0
- Allora: Lack of error handling when making blockless api callLogic error$0
- Allora: coefficients math mistakenly calculates the coefficient diff with the same valueLogic error$0
- Allora: Unchecked Error in ResetChurnableTopics FunctionLogic error$0
- Allora: RemoveStakes and RemoveDelegateStakes silently handle errors in EndBlockerLogic error$0
- Allora: `GetForecastScoresUntilBlock` can get more score samples than the max allowedLogic error$0
- Allora: topic_rewards/SafeApplyFuncOnAllActiveEpochEndingTopics used the wrong parametersLogic error$0
- Allora: `DripTopicFeeRevenue` drips the internal `topicFeeRevenue` and not the one provided by `GetCurrentTopicWeight`Logic error$0
- Allora: Malicious Reputer cause emissions/msgserver/InsertBulkReputerPayload to failLogic error$0
- Allora: Some Iterators are not closed in emissions module KeeperLogic error$0
- Allora: Incomplete Topic Processing Due to Continuous Retry on Pagination ErrorLogic error$0