Althea Liquid Infrastructure — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Althea Liquid Infrastructure, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Althea Liquid Infrastructure reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Access control, Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Access control findings disclosed against Althea Liquid Infrastructure
- Logic error findings disclosed against Althea Liquid Infrastructure
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Althea Liquid Infrastructure: Distribution can be bricked, and double claims by a few holders are possible when owner calls `LiquidInfrastructureERC20::setDistributableERC20s`
Althea's LiquidInfrastructureERC20 lets the owner swap the distributable-asset list at any time, including after the minimum distribution period has elapsed but before any pending payout is settled. Because the token array is swapped without first paying out against the old state, the next distribute() call iterates a now-inconsistent holder index and reverts with an index-out-of-bounds error, permanently bricking all future distributions. A rational holder can frontrun the owner's list change to claim the old token share first, while remaining holders — including NFT holders — are locked out of their rewards. A Forge reproducer and call trace confirm the revert, and the recommended fix gates setDistributableERC20s with a require so the list can only be swapped immediately after a distribution settles.
Althea Liquid Infrastructure: Holders array can be manipulated by transferring or burning with amount 0, stealing rewards or bricking certain functions
Althea Liquid Infrastructure's LiquidInfrastructureERC20 tracks approved token holders in an array that is appended inside the `_beforeTokenTransfer` hook whenever a recipient's balance transitions from zero. Because standard ERC20 permits zero-amount transfers and burns, an approved account can repeat these no-value operations to inject duplicate entries (including the zero address) into the holders array without ever owning real balance. The distribution routine pays out by positional index rather than unique holder, so a duplicated attacker can capture an entire yield distribution meant for all holders, and any duplicate entry causes `distributeToAllHolders()` to revert, permanently locking the distribution mechanism.