Arbitrum Foundation — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Arbitrum Foundation, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 4
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 4 closed, publicly disclosed Arbitrum Foundation reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Bridge exploit, Logic error, Front-running / MEV, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Bridge exploit findings disclosed against Arbitrum Foundation
- Logic error findings disclosed against Arbitrum Foundation
- Front-running / MEV findings disclosed against Arbitrum Foundation
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Arbitrum Foundation: Inconsistent sequencer unexpected delay in DelayBuffer may harm users calling `forceInclusion()`
Arbitrum's DelayBuffer, which determines how long users must wait before force-including delayed messages when the sequencer is down, depletes non-deterministically depending on how delayed messages are batched into forceInclusion() calls. Because the buffer decrease subtracts the last sequenced block number from the previous buffer-update block number, force-including multiple messages at once (or a newer one first) leaves the buffer larger than if messages were included sequentially in oldest-first order. As a result a user's later message can remain blocked far longer than the intended delay, locking funds for an extended period after a sequencer outage. The finding was disputed by the sponsor as by-design but ultimately accepted as Medium by the judge on availability grounds.
Arbitrum Foundation: `BOLDUpgradeAction.sol` will fail to upgrade contracts due to error in the `perform` function
The BOLDUpgradeAction contract contains a logic error that prevents the Arbitrum BOLD protocol upgrade from executing. The upgrade process attempts to refund stakers by iterating through a stored array while simultaneously modifying that same array, causing it to shrink in size. This mismatch between the loop iteration and the actual state of the array causes an array out-of-bounds error, leading to a permanent failure of the upgrade transaction.
Arbitrum Foundation: Adversary can make honest parties unable to retrieve their assertion stakes if the required amount is decreased
The Arbitrum Foundation's BOLD mechanism contained a logic error that allowed users to prematurely trigger 'inactive' status after a reduction in the required stake amount. By exploiting this gap, an attacker could artificially reduce the protocol's held stake balance below the total required to satisfy all active validator claims, leading to insolvency. This flaw effectively allowed malicious actors to lock honest participants' funds, as the contract could no longer meet the liquidity requirements for withdrawal.
Arbitrum Foundation: Edge from dishonest challenge edge tree can inherit timer from honest tree allowing confirmation of incorrect assertion
The Arbitrum BOLD protocol contained a logic error in its challenge timer mechanism that allowed for the potential confirmation of incorrect state assertions. During the bisection process, challenge timers could be incorrectly inherited across different challenge trees because the validation logic failed to distinguish between competing rival edges. An attacker could exploit this by forcing a dishonest challenge edge to inherit the timer progress accumulated by an honest validator, potentially leading to the finalization of invalid state transitions on the Arbitrum chain.