BMX Deli Swap — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for BMX Deli Swap, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 3
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 3 closed, publicly disclosed BMX Deli Swap reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Integer overflow / underflow, Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Integer overflow / underflow findings disclosed against BMX Deli Swap
- Logic error findings disclosed against BMX Deli Swap
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
BMX Deli Swap: Attacker can swap wBTC in the DeliHook multiples times to not pay / pay less swap fees
DeliHook's fee conversion for swappable tokens rounds the computed baseFeeSpecified down instead of up, so on small wBTC-amount swaps the fee truncates to zero wei, letting an attacker swap repeatedly without paying LP fees. Because wBTC has a high USD value per wei while gas on Base is cheap, iterating many small swaps in a bundled loop makes the exploit economically self-sustaining. The protocol confirmed the finding as a legitimate fee-loss bug and fixed it by rounding fee computations up in a follow-up PR.
BMX Deli Swap: Unconditional lastUpdated advance in RangePool.sync leads to loss of streamed BMX when pool liquidity == 0
BMX Deli Swap's concentrated-liquidity reward gauge can strand streamed BMX tokens when a pool has zero active liquidity at the moment of a sync. RangePool.sync updates lastUpdated before applying per-token accumulation, and accumulation is gated on liquidity > 0, so when liquidity is zero the elapsed-window amounts are skipped while lastUpdated still advances. The next sync therefore only credits amounts since the advanced timestamp, and the tokens that streamed during the zero-liquidity window remain trapped in the gauge balance, unreachable by any LP position even after liquidity returns. The correctness failure means protocol revenue intended for LPs is effectively sidelined, a lasting distribution impact rather than an immediate theft.
BMX Deli Swap: Integer Truncation in Incentive Rate Permanently Locks Unstreamed Rewards
In BMX Deli Swap's IncentiveGauge, the reward rate for a 7-day incentive is computed as `total / WEEK` using integer division, so any remainder is truncated and never streamed. At the end of the period `_updatePool` zeroes the leftover `remaining` balance instead of paying it out, so that fractional dust stays permanently locked in the contract. Every new incentive or top-up recreates and discards new dust, and the loss is proportionally larger for low-decimal tokens such as USDC/USDT. The protocol team fixed the issue by rounding the funded amount down to a full-week multiple and handling the remainder explicitly, confirming the finding.