Arcadia — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Arcadia, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 9
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 9 closed, publicly disclosed Arcadia reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Reentrancy, Integer overflow / underflow, Access control, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Arcadia
- Reentrancy findings disclosed against Arcadia
- Integer overflow / underflow findings disclosed against Arcadia
- Access control findings disclosed against Arcadia
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Arcadia: Utilisation Can Be Manipulated Far Above 100%
Arcadia's lending-v2 LendingPool computes utilisation as borrowed assets over loaned assets and derives the interest rate from it without capping the ratio at 100%. Because the only thing preventing borrows from exceeding the loaned balance is the token transfer reverting on insufficient funds, an attacker can donate ERC20 tokens directly into the pool and borrow those same tokens, driving utilisation far above 100% and inflating accrual. An early depositor can set this up on a near-empty pool, let interest accrue at an extreme rate, then redeem far more than deposited using later victims' funds. The issue was adjudicated Medium after discussion of the Silo Finance precedent (which had more leverage), the uint80 interest cap, and virtual shares limiting practical damage, and the fix capped utilisation at 100%.
Arcadia: Caching Uniswap position liquidity allows borrowing using undercollateralized Uni positions
Arcadia's Uniswap V3 asset module caches each deposited LP position's liquidity into an assetToLiquidity mapping at deposit time to prevent non-owners from inflating exposure, and reuses that cached value for all later collateral valuation. Deposits are processed in two phases — assets are first priced/cached by the registry, then actually transferred into the account — creating a window where an attacker can drain the real position liquidity. By depositing an ERC777 token ahead of the Uniswap position and draining liquidity inside the tokensToSend() hook after the cache is written but before the position's NFT transfers, a borrower can cause the protocol to value an empty position as fully collateralized and borrow against it, draining the lending pool.
Arcadia: Reentrancy in flashAction() allows draining liquidity pools
Arcadia's flash borrowing flow lets an account owner borrow pool assets that are immediately booked as debt before the borrowed funds are handed to an attacker-controlled actionTarget and before the account health check runs. When the underlying asset is an ERC777 token, the attacker's tokensReceived callback fires during that transfer, letting them liquidate their own now-insolvent account and place a tiny bid that removes just enough collateral to push the account below the creditor's minUsdValue threshold. Because getCollateralValue() then floors the collateral to zero, the liquidator's auction settlement wrongly concludes all collateral was sold, triggers the unhappy liquidation flow that burns the account's entire debt, and the outer flashAction health check passes on the now-debt-free account. The attacker keeps nearly the full borrowed sum while the liquidity pool is drained, and a PoC demonstrates stealing 100 tokens of pool liquidity.
Arcadia: Stargate `STG` rewards are accounted incorrectly by `StakedStargateAM.sol`
Arcadia's StakedStargateAM accrues Stargate staking rewards by tracking a lastRewardGlobal baseline against Stargate's LP_STAKING_TIME pending-emission counter. Stargate automatically pays out and resets that counter on every deposit/withdrawal, but the module's mint() and increaseLiquidity() paths never reset lastRewardGlobal, so the next deltaReward = currentRewardGlobal - lastRewardGlobal subtraction either underflow-reverts or silently zeroes a window of accrued rewards. This locks a user out of mint/burn/claim/rewardOf operations until the Stargate counter rebuilds, and because rewardOf() also drives collateral valuation, a staked position held as lending collateral can stall valuation for the whole lending/borrowing system.
Arcadia: L2 sequencer down will push an auction's price down, causing unfair liquidation prices, and potentially guaranteeing bad debt
Arcadia's liquidation engine runs an auction whose price decays on a half-life curve driven purely by elapsed block time, while its Registry pauses liquidations during L2 sequencer outages (plus a grace period). Because the Liquidator's price-curve logic is not gated on that downtime check, an auction that is already running keeps decaying while the sequencer is down. On recovery, a liquidator can seize 100% of the borrower's collateral while repaying only a fraction of the debt, with long outages driving the repaid percentage below 100% and guaranteeing protocol bad debt; even short outages sell collateral at an unfairly low price. The finding was upheld as medium and fixed by reverting bids during downtime and refreshing auction start time.
Arcadia: `AccountV1#flashActionByCreditor` can be used to drain assets from account without withdrawing
Arcadia's AccountV1 lets a margin account become its own owner because neither the factory transfer path nor _transferOwnership rejects self-transfer. By pairing that self-ownership with a maliciously configured creditor, an attacker calls flashActionByCreditor, whose _transferFromOwner moves a deposited ERC721 collateral (a UniswapV3 LP position) out of the account while erc721Stored is never updated, so the account's recorded collateral value stays intact. After a malicious liquidator contract restores ownership via auctionBoughtIn, the attacker can attach a legitimate creditor and borrow against phantom collateral, taking out a fully uncollateralized loan and draining lending pools. The finding was validated by the judge as high severity and fixed by blocking self-ownership.
All reports in this group
- Arcadia: `LendingPool#flashAction` is broken when trying to refinance position across `LendingPools` due to improper access controlAccess control$0
- Arcadia: `CREATE2` address collision against an Account will allow complete draining of lending poolsLogic error$0
- Arcadia: Dilution of Donations in TrancheLogic error$0