Arcadia - Aerodrome integrations — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Arcadia - Aerodrome integrations, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 3
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 3 closed, publicly disclosed Arcadia - Aerodrome integrations reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Arcadia - Aerodrome integrations
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Arcadia - Aerodrome integrations: Swapping large amounts of assets back and forth in an Aerodrome pool allows to bypass exposure limits
Arcadia's Aerodrome integration, via the WrappedAerodromeAM asset module, lets users wrap Aerodrome LP positions and deposit them as collateral in an Arcadia account. When valuing that collateral, the wrapper adds the accumulated trading fees of the LP position (fee0Position, fee1Position) on top of the wrapped amount. An attacker who controls a freshly created Aerodrome pool's entire liquidity can deposit their wrapped LP as collateral and then swap large amounts back and forth to inflate the position's accrued fees, thereby inflating the collateral's reported value while it is already deposited. This lets the attacker exceed the protocol's exposure limits without any capital loss beyond gas, weakening Arcadia's risk controls. The finding was validated during judging, and the protocol team fixed it in accounts-v2 PR #201.
Arcadia - Aerodrome integrations: WrappedAerodromeAM.sol is not compatible with the Revert on Zero Value Tokens
Arcadia's WrappedAerodromeAM asset module lets position owners claim pending Aerodrome fees and withdraw liquidity. When a pool's staked token is an ERC20 that reverts on zero-value transfers, calling decreaseLiquidity or claimFees unconditionally executes safeTransfer with a zero fee amount, which the token rejects. This causes the whole transaction to revert, permanently blocking those users from withdrawing liquidity or fees from that position. The flaw was confirmed by the Sherlock lead judge and fixed by wrapping the fee transfers in non-zero checks.
Arcadia - Aerodrome integrations: Donating (and syncing) tokens to an Aerodrome allows to bypass exposure limits
Arcadia's pricing module values Aerodrome volatile-pool LP collateral directly from the pool's current reserves. An attacker who deposits an LP token of a pool they own, then donates a large amount of the underlying tokens and calls the pool's sync() function, inflates the recorded reserves and therefore the computed collateral value of their position with near-zero loss of capital. This lets the attacker bypass the exposure limits a creditor has set. The finding was judged valid (distinct from a related #18), and the team shipped a fix via accounts-v2 pull request #201.