Asymmetry Finance — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Asymmetry Finance, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 19
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 19 closed, publicly disclosed Asymmetry Finance reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Oracle manipulation, Logic error, Front-running / MEV, Access control, Governance attack, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Oracle manipulation findings disclosed against Asymmetry Finance
- Logic error findings disclosed against Asymmetry Finance
- Front-running / MEV findings disclosed against Asymmetry Finance
- Access control findings disclosed against Asymmetry Finance
- Governance attack findings disclosed against Asymmetry Finance
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Asymmetry Finance: Price of sfrxEth derivative is calculated incorrectly
A mathematical calculation error in Asymmetry Finance's `SfrxEth.ethPerDerivative()` function inverted the Curve oracle price calculation. Instead of multiplying by the Curve oracle price and dividing by 1e18, the function multiplied by 1e18 and divided by the price. This formula error led to miscalculated ETH-per-derivative exchange rates, which mispriced user deposits during `stake()` and disrupted slippage tolerance checks in `withdraw()`, potentially locking funds or distorting share minting.
Asymmetry Finance: No slippage protection on `stake()` in SafEth.sol
Asymmetry Finance's `SafEth.sol` smart contract lacked slippage protection in its `stake()` function when minting `safETH` tokens to users. The amount of `safETH` minted depends on the real-time valuation of the contract's underlying liquid staking derivative tokens relative to total supply. Without a user-defined minimum output parameter, transactions could be subjected to adverse price movements, front-running, or sandwich attacks, resulting in users receiving fewer minted tokens than expected.
Asymmetry Finance: Possible DoS on `unstake()`
Asymmetry Finance's unstaking mechanism interacts with RocketPool's rETH token, which contains an integrated deposit delay mechanism preventing token transfers or burns shortly after deposits. If RocketPool's deposit delay parameter is non-zero, any new deposit triggered during a user stake resets the transfer lock timer for all held rETH. A malicious actor could exploit this by repeatedly calling stake with minimal amounts to continuously reset the timer, effectively freezing unstake operations and locking user funds indefinitely.
Asymmetry Finance: Stuck ether when use function `stake` with empty `derivatives`(`derivativeCount` = 0)
In Asymmetry Finance's SafEth contract, users calling the stake function prior to the administrator calling addDerivative cause native ETH to become permanently locked in the contract. Because derivativeCount is zero during this initial state, loops calculating derivative values and minting receipt tokens are skipped entirely while msg.value is still retained by the smart contract. Users receive zero receipt tokens in exchange for their deposited ETH with no capability to withdraw or recover the funds.
Asymmetry Finance: Lack of deadline for uniswap AMM
In Asymmetry Finance's `Reth` derivative contract, swaps executed through Uniswap V3's `ISwapRouter.exactInputSingle` lacked a user-specified deadline parameter. Without a transaction expiration timestamp, miners or MEV bots could withhold transaction execution until market conditions deteriorated or slippage increased, allowing sandwich attacks and unfavorable trade execution for depositors. The issue requires introducing a deadline parameter derived from transaction submission time to enforce timely execution.
Asymmetry Finance: Missing derivative limit and deposit availability checks will revert the whole `stake()` function
When users attempt to stake ETH via Asymmetry Finance's `SafEth` contract, the system splits deposits across multiple underlying liquid staking derivatives (e.g., wstETH, rETH) according to assigned weights. If any individual derivative contract reverts during deposit—such as when Lido's daily staking limit is reached or Rocket Pool's deposit pool capacity is exhausted—the entire `stake()` transaction fails. Because the batch iteration lacks fallback handling or status validation for external deposit constraints, users are unable to deposit ETH into the protocol whenever a single underlying derivative pool becomes temporarily unavailable.
All reports in this group
- Asymmetry Finance: `Reth.sol`: Withdrawals are unreliable and depend on excess `RocketDepositPool` balance which can brick the whole protocolAccess control$0
- Asymmetry Finance: Residual ETH unreachable and unutilized in SafEth.solAccess control$0
- Asymmetry Finance: In de-peg scenario, forcing full exit from every derivative & immediately re-entering can cause big losses for depositorsGovernance attack$0
- Asymmetry Finance: Potential `stake()` DoS if sole safETH holder (ie: first depositor) unstakes `totalSupply` - 1Logic error$0
- Asymmetry Finance: Non-ideal rETH/WETH pool used pays unnecessary feesGovernance attack$0
- Asymmetry Finance: DoS due to external call failureReentrancy$0
- Asymmetry Finance: Division before multiplication truncate `minOut` and incurs heavy precision loss and result in insufficient slippage protectionAccess control$0
- Asymmetry Finance: `WstEth` derivative assumes a `~1=1` peg of stETH to ETHOracle manipulation$0
- Asymmetry Finance: Reth `poolPrice` calculation may overflowOracle manipulation$0
- Asymmetry Finance: sFrxEth may revert on redeeming non-zero amountLogic error$0
- Asymmetry Finance: Users can fail to unstake and lose their deserved ETH because malfunctioning or untrusted derivative cannot be removedAccess control$0
- Asymmetry Finance: An attacker can manipulate the preDepositvePrice to steal from other usersInteger overflow/underflow$0
- Asymmetry Finance: Staking, unstaking and rebalanceToWeight can be sandwiched (Mainly rETH deposit)Oracle manipulation$0