BadgerDAO — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for BadgerDAO, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed BadgerDAO reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Flash loan attack, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against BadgerDAO
- Flash loan attack findings disclosed against BadgerDAO
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
BadgerDAO: Incorrect comparison logic in post-operation checks
The LeverageMacroBase contract in the BadgerDAO eBTC protocol contains a critical logic error in its post-operation validation function, _doCheckValueType. The function inadvertently reverses the comparison logic for 'greater than or equal to' and 'less than or equal to' operators, causing it to validate against incorrect conditions. This allows leverage operations to proceed even when they result in invalid or unsafe states for Collateralized Debt Positions (CDPs). Consequently, the protocol fails to enforce its core safety constraints, potentially exposing the system to financial risk through manipulated CDP states.
BadgerDAO: Staking ETH incorrectly assumes revert bubbling
The BadgerDAO zap router contracts incorrectly utilize a low-level call to interact with the Lido stETH deposit function. Because low-level calls do not automatically propagate reverts, the system fails to detect if a Lido deposit attempt is blocked by protocol pauses or staking limits. Consequently, the transaction continues as if the deposit succeeded, leading to incorrect state and collateral accounting within the eBTC leverage flow. While downstream checks may eventually catch the resulting insufficient balance, the silent failure mode represents a flaw in contract reliability and exception handling.