Amphora Protocol — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Amphora Protocol, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 6
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 6 closed, publicly disclosed Amphora Protocol reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Oracle manipulation, Flash loan attack, Logic error, Front-running / MEV, Reentrancy, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Oracle manipulation findings disclosed against Amphora Protocol
- Flash loan attack findings disclosed against Amphora Protocol
- Logic error findings disclosed against Amphora Protocol
- Front-running / MEV findings disclosed against Amphora Protocol
- Reentrancy findings disclosed against Amphora Protocol
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Amphora Protocol: When Convex pool is shut down while collateral type is `CurveLPStakedOnConvex`, users unable to deposit that asset and protocol lose the ability to accept the asset as collateral further
The Amphora Protocol's integration with Convex exposes a denial of service vulnerability whenever an underlying Convex pool or booster contract is shut down. Because the Vault protocol mandates interaction with Convex for specific collateral types, any pool decommissioning causes the vault's deposit functionality to fail, effectively bricking that asset type for the protocol. Additionally, the system's internal state tracking fails to update properly during total withdrawals, which can block necessary liquidation processes for existing users. The issue is exacerbated by the lack of administrative functions to reconfigure the collateral type of an asset once it is no longer safely stakeable on Convex.
Amphora Protocol: Rounding error in `WUSDA` can result in loss of user funds, especially when manipulated by an attacker
The Amphora Protocol's `WUSDA` contract contains a critical rounding error in its conversion logic. Because the contract uses integer division when calculating the exchange rate between USDA and WUSDA, large fluctuations in the total supply of USDA—which can be induced by flash loans—cause the returned amount of WUSDA to be rounded down. An attacker can leverage this by manipulating the total supply to front-run legitimate user transactions, causing victims to receive fewer tokens than they are entitled to or potentially allowing the attacker to withdraw funds without properly burning the associated WUSDA shares.
Amphora Protocol: crvRewardsContract `getReward` can be called directly, breaking vaults `claimRewards` functionallity
The Amphora Protocol's Vault relies on an external Convex Finance contract to claim rewards for staked Curve LP positions. Because Convex allows any user to trigger the reward distribution for any address, an attacker can prematurely trigger the claiming process on behalf of the Vault. This bypasses the Vault's internal logic, which is designed to claim these rewards as part of a controlled accounting process, subsequently preventing the proper distribution of AMPH rewards to users.
Amphora Protocol: Reorg attack on user's Vault deployment and deposit may lead to theft of funds
Amphora Protocol's use of the `create` opcode for deploying Vault contracts creates a predictable address derivation vulnerability. An attacker can exploit this by front-running a user's deployment transaction, effectively claiming the vault address for themselves and replacing the vault's controller with a malicious version. This allows the attacker to silently intercept and steal funds that the user subsequently deposits into the compromised vault, particularly under conditions of network instability or chain reorganizations.
Amphora Protocol: `Vault.claimRewards` can break if Convex changes the operator
The Amphora Vault's reward claiming process is vulnerable to a denial-of-service attack due to a faulty integration with the Convex protocol. The Vault incorrectly assumes that claiming rewards will always result in the minting of CVX tokens; however, if Convex enters a shutdown state, it ceases minting CVX without reverting. Because the Vault relies on this minting to execute successfully, any attempt to claim rewards while the protocol is in this state will fail, rendering accumulated user rewards inaccessible.
Amphora Protocol: Reentrancy issue with the `withdraw` method of USDC. All tokens could be drained.
The Amphora protocol's withdrawal mechanism for sUSD contains a critical reentrancy vulnerability due to improper ordering of operations. The internal _withdraw function performs a token transfer before burning the user's corresponding tokens, which violates the Checks-Effects-Interactions pattern. An attacker can exploit this by using a malicious contract to trigger recursive calls within a single transaction, enabling them to drain the protocol's entire reserve.