Autonomint Colored Dollar V1 — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Autonomint Colored Dollar V1, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 40
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 40 closed, publicly disclosed Autonomint Colored Dollar V1 reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Reentrancy, Logic error, Integer overflow / underflow, Access control, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Reentrancy findings disclosed against Autonomint Colored Dollar V1
- Logic error findings disclosed against Autonomint Colored Dollar V1
- Integer overflow / underflow findings disclosed against Autonomint Colored Dollar V1
- Access control findings disclosed against Autonomint Colored Dollar V1
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Autonomint Colored Dollar V1: Cross-Contract Reentrancy Vulnerability in CDS Withdraw Function
Autonomint Colored Dollar V1's CDS.withdraw flow caches the protocol-global omniChainData struct into memory at entry and only writes it back to storage at the very end of the transaction. For users who opted into liquidation gains, the treasury pays out ETH through a low-level .call mid-execution, handing control to the caller before that write-back occurs. A malicious user who reenters the borrowing contract during that window can make legitimate global mutations, which the stale in-memory copy then overwrites on return. Repeating this corrupts shared global accounting and can drive metrics like totalVolumeOfBorrowersAmountinWei artificially low, breaking downstream calculations and ultimately blocking withdrawals from the borrowing contract.
Autonomint Colored Dollar V1: No slippage protection when exchanging with synthethix
Autonomint's liquidationType2 flow swaps sETH for sUSD through Synthetix's exchange() but discards the returned amountReceived and instead derives the Perps V2 margin from the nominal ETH amount. Because the actual sUSD received is marginally less than the nominal value under normal market slippage, transferMargin can fail for lack of funds, reverting the whole transaction. Since this path is admin-invoked and liquidations must remain continuously available, the revert bricks the liquidation flow for the affected borrower, producing a denial of service. The proposed fix is to base the margin on the real amountReceived and enforce a small slippage tolerance (0–0.5%).
Autonomint Colored Dollar V1: `Treasury.noOfBorrowers` can be set to 0 by looping wei deposit<->withdrawals and DoS withdrawals and reset borrower debt
Autonomint's Treasury tracks an active-borrower count that is incremented only on a user's very first deposit but decremented every time that user's deposited balance returns to zero. Because the two triggers are asymmetric, a single user can deposit and withdraw tiny (wei-level) amounts in a loop to drain the counter to zero even while many real borrowing positions remain open. With the counter underflowed at zero, legitimate borrower withdrawals revert (denial of service) and BorrowLib's debt-accrual logic resets accumulated debt to zero. This lets one attacker lock user funds and shift losses onto the protocol.
Autonomint Colored Dollar V1: Cross-chain wrsETH amount is wrapped before the treasury have received it, which could revert the whole transaction
When a dCDS depositor who opted into liquidations withdraws, the protocol may need to retrieve collateral such as rsETH from another chain through LayerZero. The withdrawal flow issues the cross-chain request and in the same transaction immediately calls wrapRsETH on the requested amount, but the collateral has not yet arrived on the current chain. Because LayerZero's round-trip delivery takes time, the wrap operates on funds the treasury does not yet hold, causing the entire withdrawal transaction to revert. The result is that opted-in users cannot withdraw their dCDS positions whenever the needed rsETH is not already present locally, a denial-of-service/availability regression.
Autonomint Colored Dollar V1: Wrong state update in `liquidationType1` call
In Autonomint's Colored Dollar V1 lending system, the liquidation accounting path writes to the wrong treasury accumulator. In borrowLiquidation.liquidationType1, the 20% liquidation return is credited to abondUSDaPool via updateAbondUSDaPool instead of to the dedicated usdaGainedFromLiquidation balance via updateUSDaGainedFromLiquidation. Because usdaGainedFromLiquidation is never populated, the liquidation-yield ratio computed in BorrowLib.redeemYields is always zero and users redeeming aBond yields never receive liquidation-sourced USDA. The result is permanently broken core yield functionality with liquidation proceeds mis-routed into an accounting bucket where they are never distributed to yield users.
Autonomint Colored Dollar V1: Total cds deposited amount is incorrectly modified when cds depositor is at a loss, leading to stuck USDa
The Autonomint CDS (collateralized debt) module corrupts its running bookkeeping total of deposited USDa whenever a depositor withdraws while at a loss. In CDSLib.sol:713 the contract decreases totalCdsDepositedAmount by the full returned amount — which already includes the loss the depositor absorbed — so the denominator used for subsequent per-share cumulative-value math no longer equals the sum of the remaining individual deposits. This accounting drift permanently sticks USDa in the contract, produces a shortfall on withdrawal for remaining depositors, and, if a borrower withdraws under further price decline, drives the total negative and underflows. The flaw requires no special preconditions and is triggered purely by ordinary price movements and normal withdrawals, making it a high-impact availability and fund-loss bug in the lending/CDS flow.
All reports in this group
- Autonomint Colored Dollar V1: The user overpays the USDA amount for downside protection while withdrawingLogic error$0
- Autonomint Colored Dollar V1: Type 1 borrower liquidation will incorrectly add cds profit directly to `totalCdsDepositedAmount`Logic error$0
- Autonomint Colored Dollar V1: After closing synthetix position we don't update global data for liquidationsLogic error$0
- Autonomint Colored Dollar V1: DOS on liquidation type 1 due to underflow in cds profits computationLogic error$0
- Autonomint Colored Dollar V1: wrong amount of `sUSD` is used to open a short position in synthetixLogic error$0
- Autonomint Colored Dollar V1: Malicious users can DOS the protocol by setting downsideProtected to a large valueLogic error$0
- Autonomint Colored Dollar V1: `Borrowing::redeemYields` debits `ABOND` from `msg.sender` but redeems to `user` using `ABOND.State` data from `user`Logic error$0
- Autonomint Colored Dollar V1: Reentrant call in `Treasury::withdrawFromExternalProtocol` during the `Borrowing::redeemYields` flow allows theft of `Treasury` ETHReentrancy$0
- Autonomint Colored Dollar V1: odosAssembledData can be manipulatedLogic error$0
- Autonomint Colored Dollar V1: `borrowing::withdraw()` at a loss will increase downside protected and misscalculate option feesLogic error$0
- Autonomint Colored Dollar V1: omniChainData.cdsPoolValue is not decreased/updated in the function liquidationType1,as a result cds/ borrow ratio will be bigger than expected.Logic error$0
- Autonomint Colored Dollar V1: Withdrawing ionic during liquidation has a flawLogic error$0
- Autonomint Colored Dollar V1: Lock-in period option for dCDS users is not enforced when trying to withdraw.Logic error$0
- Autonomint Colored Dollar V1: Inability to Withdraw ETH/tokens in BorrowLiquidation Contract if `closeThePositionInSynthetix` is CalledLogic error$0
- Autonomint Colored Dollar V1: excess funds will not always be refunded to borrower when they are withdrawingLogic error$0
- Autonomint Colored Dollar V1: `liquidationType2` will self DOS due to lack of ETHLogic error$0
- Autonomint Colored Dollar V1: Missing Update to `omnichain.totalAvailableLiquidationAmount` in `withdrawUser`Logic error$0
- Autonomint Colored Dollar V1: Malicious users can block admins from accessing setter functionsAccess control$0
- Autonomint Colored Dollar V1: Borrower withdrawing at a loss will cause losses for cds depositors that only withdraw after the price recoversLogic error$0
- Autonomint Colored Dollar V1: `totalCdsDepositedAmountWithOptionFees` is incorrectly reduced in `CDSLib::withdrawUser()`, leading to stuck option feesLogic error$0
- Autonomint Colored Dollar V1: Logical Error in Timestamp Condition for Option Renewal `BorrowLib.getOptionFeesToPay()`Logic error$0
- Autonomint Colored Dollar V1: Missing cds deposit amount in swapCollateralForUSDTLogic error$0
- Autonomint Colored Dollar V1: Health ratio is hardcoded causing issues once the LTV is updatedLogic error$0
- Autonomint Colored Dollar V1: when the liquidate function(function liquidationType1) is called vaultvalue(liquidated collateral value) is not decreased from omniChainData.vaultValue. As a result, the cds/borrow ratio will always be less than the real cds/borrow ratio.Logic error$0
- Autonomint Colored Dollar V1: Borrowers can choose any volatility in order to pay less feesLogic error$0
- Autonomint Colored Dollar V1: Protected downside is not updated when `cds.getTotalCdsDepositedAmount() < downsideProtected`Logic error$0
- Autonomint Colored Dollar V1: Cds amounts to reduce from each chain are incorrect and will lead to the inability to withdraw cds in one of the chainsLogic error$0
- Autonomint Colored Dollar V1: `borrowing::liquidate()` sends the wrong liquidation index to the destination chain, overwritting liquidation information and getting collateral stuckLogic error$0
- Autonomint Colored Dollar V1: Liquidation will reduce total cds deposited amount, leading to incorrect option feesLogic error$0
- Autonomint Colored Dollar V1: Inconsistent Use of `lastCumulativeRate` in `depositTokens()` and `withdraw()` Functions in `Borrowings` ContractLogic error$0
- Autonomint Colored Dollar V1: Users can withdraw liquidated collateralLogic error$0
- Autonomint Colored Dollar V1: Lack of lastEthPrice sync between different chainsLogic error$0
- Autonomint Colored Dollar V1: `ABONDToken::transferFrom` does not work as intended and allows theft of ETH funds from `Treasury`Logic error$0
- Autonomint Colored Dollar V1: DOS to `liquidateBorrowPosition` on MODE chainLogic error$0