BakerFi — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for BakerFi, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 10
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 10 closed, publicly disclosed BakerFi reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Oracle manipulation, Flash loan attack, Reentrancy, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against BakerFi
- Oracle manipulation findings disclosed against BakerFi
- Flash loan attack findings disclosed against BakerFi
- Reentrancy findings disclosed against BakerFi
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
BakerFi: All supplied WETH to Aave as a deposit by a Strategy will be irrecoverable
The BakerFi leverage strategy incorrectly handles excess WETH generated during debt repayment by automatically supplying it to Aave as collateral. This design is flawed because the strategy's withdrawal logic is restricted to only reclaiming the primary collateral asset and lacks any mechanism to withdraw deposited WETH. As a result, any excess WETH deposited in this manner becomes permanently irrecoverable, leading to a loss of user funds.
BakerFi: `ETHOracle.getLatestPrice` needs to convert to 18 decimals
The BakerFi protocol suffers from a critical precision mismatch in its ETHOracle contract, which fails to normalize Chainlink's 8-decimal ETH/USD price feed to the protocol's expected 18-decimal standard. This error causes significant inaccuracies when the protocol calculates the value of collateral in ETH during borrowing or liquidation checks. As a result, users can manipulate their borrowing capacity or potentially avoid liquidation due to the miscalculated collateral valuation.
BakerFi: Multiple swap lack slippage protection
The BakerFi protocol failed to implement slippage protection in its Uniswap V3 swap integration. Specifically, the _swap function and several downstream calls incorrectly set the amountOutMinimum parameter to zero. This vulnerability allows attackers to perform sandwich attacks, manipulating the pool price to force the protocol to execute trades at highly unfavorable rates, ultimately leading to a loss of protocol capital.
BakerFi: Vault can be DoS
BakerFi vaults are susceptible to a Denial of Service attack because the share conversion logic fails to correctly initialize when collateral is present but total share supply is zero. An attacker can donate collateral tokens to the vault contract to force the share calculation into a mathematical branch that always returns zero for any new deposit. This prevents legitimate users from successfully depositing funds and minting shares, effectively locking the vault. The issue is mitigated by checking if either assets or shares are zero, ensuring proper initialization of the vault's state.
BakerFi: `StrategyLeverage.harvest` doesn't account flashloan fee
The BakerFi StrategyLeverage contract fails to accurately account for flash loan fees during automated position rebalancing. When the protocol repays excess debt to lower a high LTV ratio, the internal accounting fails to deduct the fee from the collateral, resulting in an incorrectly inflated assessment of the position's value. This accounting error leads to inaccurate profit reporting and potential under-collection of management fees for the protocol.
BakerFi: Vault is vulnerable to first depositor inflation attack
The BakerFi Vault is vulnerable to a first-depositor inflation attack, allowing an attacker to manipulate the exchange rate between assets and shares. By performing an initial minimal deposit and subsequently donating collateral tokens directly to the strategy, the attacker artificially inflates the vault's assets. This ensures that subsequent depositors receive minimal shares due to rounding down in the division-based minting formula, enabling the original attacker to drain a portion of the victim's deposited funds upon withdrawal.
All reports in this group
- BakerFi: Min and maxAnswer never checked for oracle price feedOracle manipulation$0
- BakerFi: `BalancerFlashLender#receiveFlashLoan` does not validate the `originalCallData`Flash loan attack$0
- BakerFi: Rounding-down of `flashFee` can result in calls to flash loan to revertReentrancy$0
- BakerFi: When harvesting a strategy and adjusting the debt, all the leftover collateral that is not used to swap the withdrawn collateral from Aave for WETH to repay the flashloan will be locked and lost in the Strategy contractFlash loan attack$0