BakerFi — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for BakerFi, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 12
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 12 closed, publicly disclosed BakerFi reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Oracle manipulation, Reentrancy, Flash loan attack, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against BakerFi
- Oracle manipulation findings disclosed against BakerFi
- Reentrancy findings disclosed against BakerFi
- Flash loan attack findings disclosed against BakerFi
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
BakerFi: All supplied WETH to Aave as a deposit by a Strategy will be irrecoverable
The BakerFi leverage strategy incorrectly handles excess WETH generated during debt repayment by automatically supplying it to Aave as collateral. This design is flawed because the strategy's withdrawal logic is restricted to only reclaiming the primary collateral asset and lacks any mechanism to withdraw deposited WETH. As a result, any excess WETH deposited in this manner becomes permanently irrecoverable, leading to a loss of user funds.
BakerFi: Protocol receives less harvest fees
BakerFi's Vault harvest logic underpays the protocol its configured performance fee because fee shares are minted against the total supply that exists before the mint. Each issued share therefore claims a slightly smaller ETH amount than the configured percentage once the mint inflates totalSupply. The provided example shows a 10 ETH fee at a 10% rate yielding only about 9.999 ETH of effective claim per harvest. This dilutive shortfall repeats each profitable harvest, so the protocol cumulatively receives less than its configured fee. The sponsor acknowledged the finding and agreed the formula must account for the supply increase introduced by the mint.
BakerFi: `ETHOracle.getLatestPrice` needs to convert to 18 decimals
The BakerFi protocol suffers from a critical precision mismatch in its ETHOracle contract, which fails to normalize Chainlink's 8-decimal ETH/USD price feed to the protocol's expected 18-decimal standard. This error causes significant inaccuracies when the protocol calculates the value of collateral in ETH during borrowing or liquidation checks. As a result, users can manipulate their borrowing capacity or potentially avoid liquidation due to the miscalculated collateral valuation.
BakerFi: Rounding-down of `flashFee` can result in calls to flash loan to revert
The BakerFi protocol's flash loan fee calculation relied on rounding-down integer division, leading to insufficient spend allowances for flash loan providers. When a user initiated a leverage strategy, the protocol granted an allowance that was strictly less than the fee required by the lender's own rounding-up calculation. This discrepancy caused flash loan calls to revert, effectively preventing the successful execution of leverage strategies for many amount and fee percentage combinations.
BakerFi: When harvesting a strategy and adjusting the debt, all the leftover collateral that is not used to swap the withdrawn collateral from Aave for WETH to repay the flashloan will be locked and lost in the Strategy contract
The BakerFi strategy contract suffers from a logic flaw during the harvesting process where it incorrectly calculates the amount of collateral required to repay a flash loan. By using a hardcoded fee tier for price estimation, the contract frequently withdraws excessive collateral from Aave. Because the leftover collateral is then improperly handled and trapped within the strategy contract rather than being returned to the lending pool, user funds are leaked and become locked, reducing the overall capital efficiency and security of the strategy.
BakerFi: Vault is vulnerable to first depositor inflation attack
The BakerFi Vault is vulnerable to a first-depositor inflation attack, allowing an attacker to manipulate the exchange rate between assets and shares. By performing an initial minimal deposit and subsequently donating collateral tokens directly to the strategy, the attacker artificially inflates the vault's assets. This ensures that subsequent depositors receive minimal shares due to rounding down in the division-based minting formula, enabling the original attacker to drain a portion of the victim's deposited funds upon withdrawal.
All reports in this group
- BakerFi: Vault can be DoSLogic error$0
- BakerFi: `deposit()` `afterDeposit` calculation formula is incorrectLogic error$0
- BakerFi: Multiple swap lack slippage protectionOracle manipulation$0
- BakerFi: `StrategyLeverage.harvest` doesn't account flashloan feeFlash loan attack$0
- BakerFi: `BalancerFlashLender#receiveFlashLoan` does not validate the `originalCallData`Flash loan attack$0
- BakerFi: Min and maxAnswer never checked for oracle price feedOracle manipulation$0