Althea Liquid Infrastructure — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Althea Liquid Infrastructure, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 5
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 5 closed, publicly disclosed Althea Liquid Infrastructure reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Front-running / MEV, Access control, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Althea Liquid Infrastructure
- Front-running / MEV findings disclosed against Althea Liquid Infrastructure
- Access control findings disclosed against Althea Liquid Infrastructure
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Althea Liquid Infrastructure: Holders array can be manipulated by transferring or burning with amount 0, stealing rewards or bricking certain functions
Althea Liquid Infrastructure's LiquidInfrastructureERC20 tracks approved token holders in an array that is appended inside the `_beforeTokenTransfer` hook whenever a recipient's balance transitions from zero. Because standard ERC20 permits zero-amount transfers and burns, an approved account can repeat these no-value operations to inject duplicate entries (including the zero address) into the holders array without ever owning real balance. The distribution routine pays out by positional index rather than unique holder, so a duplicated attacker can capture an entire yield distribution meant for all holders, and any duplicate entry causes `distributeToAllHolders()` to revert, permanently locking the distribution mechanism.
Althea Liquid Infrastructure: Malicious users can prevent holders from claiming their rewards during a reward cycle by skipping it.
Althea's LiquidInfrastructureERC20 accrues yield inside managed liquid NFTs and pays holders each distribution cycle, gated by a block-based MinDistributionPeriod. Because withdraw functions revert while LockedForDistribution is true, any unprivileged account can call distribute() when no meaningful reward balance is payable, flipping the lock and freezing all withdrawals for the full period. This lets anyone push a genuine reward cycle out by roughly a week or a month, temporarily griefing approved holders out of accrued rewards and breaking the core hold-and-earn loop. The judge accepted it as a valid medium temporary-grief issue, and the recommended fix prevents a cycle from starting when no payable rewards are held.
Althea Liquid Infrastructure: Withdrawal from NFTs can be temporarily blocked
Althea's LiquidInfrastructureERC20 collects revenue from a managed set of NFT vaults by iterating over the ManagedNFTs array with a persistent nextWithdrawal cursor that resets only when it exactly equals the array length. If managed NFTs are released between withdrawal rounds, or a withdrawal is front-run against a release, the cursor can land beyond the end of the array, so the reset condition never fires and every subsequent withdrawal loop executes zero iterations, permanently blocking revenue collection from the remaining NFTs. The sponsor confirmed the issue as a medium-severity denial of service, and the accepted fix widens the reset to a greater-or-equal comparison. The report also flags a contingent reentrancy path that could reintroduce the same desync if the project ever adopted safeTransferFrom.
Althea Liquid Infrastructure: Distribution can be bricked, and double claims by a few holders are possible when owner calls `LiquidInfrastructureERC20::setDistributableERC20s`
Althea's LiquidInfrastructureERC20 lets the owner swap the distributable-asset list at any time, including after the minimum distribution period has elapsed but before any pending payout is settled. Because the token array is swapped without first paying out against the old state, the next distribute() call iterates a now-inconsistent holder index and reverts with an index-out-of-bounds error, permanently bricking all future distributions. A rational holder can frontrun the owner's list change to claim the old token share first, while remaining holders — including NFT holders — are locked out of their rewards. A Forge reproducer and call trace confirm the revert, and the recommended fix gates setDistributableERC20s with a require so the list can only be swapped immediately after a distribution settles.
Althea Liquid Infrastructure: `LiquidInfrastructureERC20.sol` disapproved holders keep part of the supply, diluting approved holders revenue.
Althea's LiquidInfrastructureERC20 distributes accumulated reward-token balances to approved holders by dividing the balance by the total token supply and paying each holder a proportional share. When the owner revokes a holder via the routine disapprovedHolder flow, the removed holder keeps their tokens, which continue to inflate the supply denominator and shrink every remaining approved holder's payout each cycle, stranding residual rewards in the contract that only recirculate in later rounds. No external attacker is needed — the loss is triggered purely by routine owner administration, so approved holders receive less revenue per cycle than they are entitled to. The sponsor confirmed this was not intended design and the judge upheld medium severity, reasoning that only part of the revenue is affected and the residual funds are not permanently lost.