Axis Finance — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Axis Finance, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 18
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 18 closed, publicly disclosed Axis Finance reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Integer overflow / underflow, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Axis Finance
- Integer overflow / underflow findings disclosed against Axis Finance
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Axis Finance: Auction creators have the ability to lock bidders' funds.
Axis Finance's EMPAM batch auction module contains an off-by-one boundary bug in its lifecycle checks. Because the conclusion check uses strict inequality (conclusion < block.timestamp), an auction creator can call cancelAuction in the exact block when block.timestamp equals the conclusion, a moment where the lot is neither considered active nor concluded. Cancellation sets the lot's capacity to zero and flips status to Claimed, which makes refundBid always revert. Settlement is then unreachable because the creator can withhold the private key or submit one without decrypting bids, forcing decryptAndSortBids to revert forever. The net effect is that bidders' quote tokens are permanently locked in the auction house. The confirmed fix changed the boundary to inclusive inequality and made start/conclusion timestamps consistent across functions, and the fix was signed off by the lead senior Watson.
Axis Finance: Attacker can forbid users to get refunded if sends enough bids on the EMPAM module
Axis Finance's EMPAM auction module had a gas-exhaustion denial-of-service flaw. The _refundBid function locates a requested bid by linearly scanning the entire encrypted-bid array before popping the entry, so an attacker who floods an auction with many minimum-amount bids forces any legitimate user refunding a later bid to consume gas beyond the block limit, breaking the refund path and risking user funds. The finding was upheld at Medium severity and fixed in PR Axis-Fi/moonraker#145, which stores each bid's array index in a mapping so refunds no longer iterate the full list.
Axis Finance: Inaccurate value is used for partial fill quote amount when calculating fees
Axis Finance's AuctionHouse miscomputes the quote-token amount attributed to a partially filled bid when allocating protocol and referrer fees. During settle(), the partial-fill fee input is derived as a proportional mulDivDown(pfPayout, totalIn, totalOut), which can overstate the bidder's actual retained contribution (bidAmount - pfRefund). Because fees are accrued per-claim in claimBids but later subtracted as a lump sum in claimProceeds, the over-allocated fees can exceed the fees actually captured from the seller, leaving insufficient tokens in the contract so that reward collection or seller proceeds withdrawal reverts. The medium-severity finding was confirmed, fixed by computing the fee input as bidClaim.paid - bidClaim.refund (PR #140), and signed off.
Axis Finance: Malicious user can overtake a prefunded auction and steal the deposited funds
Axis Finance's Auctioneer.auction() writes routing details to lotRouting[lotId] using a storage reference bound before lotId is actually assigned; because the return-value variable initially holds 0, the reference always points to lotRouting[0]. An attacker who creates a second, non-prefunded auction immediately after an honest user's prefunded lot overwrites slot 0 with themselves as seller while preserving the deposited funding, then calls cancel(0, ...) to receive the honest user's base-token deposit with no capital of their own at risk. The finding was upheld and fixed in Axis-Fi/moonraker PR #132 by moving the lot-id increment ahead of the storage read, signed off by the Lead Senior Watson.
Axis Finance: Bidders' funds may become locked due to inconsistent price order checks in MaxPriorityQueue and the _claimBid function.
Axis Finance's Encrypted Marginal Price Auction module orders bids in its MaxPriorityQueue using a cross-multiplication comparison (q1*b2 < q2*b1), while _claimBid validates a bidder's win status by comparing a price computed via Math.mulDivUp directly against the marginal price. Because these two computations round differently, a bid priced exactly at the marginal price can be ordered after the marginal bid in the queue even though its computed price matches and its bid ID is smaller. Such a non-winner is then allowed to claim base tokens from the finite settlement supply, and if that ineligible bidder claims before a genuine winner, a real winner is left unable to claim and their quote tokens stay locked in the auction house. The finding was confirmed by the protocol team and fixed in PR #146, with the Lead Senior Watson signing off on the resolution.
Axis Finance: Bidders can not claim their bids if the auction creator claims the proceeds.
Axis Finance's EncryptedMarginalPriceAuctionModule uses a lot-level status field that transitions from Settled to Claimed when the auction creator calls claimProceeds. The bidder-facing claimBids path enforces that a lot is still Settled, so once the creator claims proceeds before bidders claim their bids, bidders can never retrieve their quote tokens or receive base tokens, leaving those funds locked in the auction house. The teams fixed the flaw by replacing the Claimed status with a boolean flag, so that a settled lot's status now remains Settled even after proceeds are claimed, and the Lead Senior Watson signed off on the resolution.
All reports in this group
- Axis Finance: If pfBidder gets blacklisted the settlement process would be broken and every other bidders and the seller would lose their fundsLogic error$0
- Axis Finance: It is possible to DoS batch auctions by submitting invalid AltBn128 points when biddingLogic error$0
- Axis Finance: [M-1]Logic error$0
- Axis Finance: Settlement of batch auction can exceed the gas limitLogic error$0
- Axis Finance: Module's gas yield can never be claimed and all yield will be lostLogic error$0
- Axis Finance: Bidder's payout claim could fail due to validation checks in LinearVestingLogic error$0
- Axis Finance: Unsold tokens from a FPAM auction, will be stuck in the protocol, after the auction concludesLogic error$0
- Axis Finance: Downcasting to uint96 can cause assets to be lost for some tokensInteger overflow/underflow$0
- Axis Finance: Overflow in curate() function, results in permanently stuck fundsInteger overflow/underflow$0
- Axis Finance: User's can be grieved by not submitting the private keyLogic error$0
- Axis Finance: Unsafe casting within _purchase function can result in overflowInteger overflow/underflow$0
- Axis Finance: Incorrect `prefundingRefund` calculation will disallow claimingLogic error$0