Coded Estate — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Coded Estate, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 10
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 10 closed, publicly disclosed Coded Estate reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity, Cosmos-SDK. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Coded Estate
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Coded Estate: Use of `u64` for `price_per_day` and `price_per_month` limits handling tokens with 18 decimals
Coded Estate stores the daily and monthly rental prices for listed properties as u64 in both the message enums and the handler functions. Because u64 maxes out around 1.84e19, any pricing in an 18-decimal token is capped at roughly 18 whole tokens, whereas token amounts elsewhere in the contract use u128. This prevents landlords from listing higher-priced properties paid in common 18-decimal assets. The Code4rena judge upheld it as a genuine functional limitation, while the sponsor noted the platform currently uses 6-decimal tokens, so no funds are at risk.
Coded Estate: Token owner can burn their token with active rental leading to renters' funds being stuck
Coded Estate tokenizes real-estate properties as ERC-721s that can be listed for short-term rentals, with each token carrying a per-token rental record that tracks renter prepaid deposits and cancellation bookkeeping. The token burn function erases all data associated with a token but only checks that the caller is the owner or an approved operator, never validating whether any active rental exists. A property owner can therefore burn the token mid-reservation, wiping the deposit records so that when renters attempt to cancel and claim refunds the transaction reverts against the deleted state, permanently stranding their funds in the contract. The recommended fix is to add a precondition to burn that rejects the call while any active rental is attached to the token.
Coded Estate: Adversary can use `send_nft` to bypass the payment and steal seller's token in auto-approve scenario
Coded Estate's CosmWasm NFT marketplace exposes two token-transfer entry points with asymmetric behavior: transfer_nft settles the USDC payment to the seller, while send_nft performs a bare CW721 transfer with no payment logic. When a seller lists a token with auto_approve enabled, a bidder is granted transfer approval via setbidtobuy; because send_nft shares that approval but skips trade settlement, a malicious bidder can send the token to their own contract that implements Cw721ReceiveMsg, then cancel the bid for a full refund. Net effect: the attacker keeps both the NFT and their funds while the seller loses the token and receives nothing. A complete Rust PoC test demonstrates the exploit passes, and the sponsor acknowledged the finding, which was independently duplicated by a second auditor.
Coded Estate: Insufficient price validation in `transfer_nft` function enables theft of listed tokens
Coded Estate is a CosmWasm NFT marketplace where owners list tokens for sale at a set price and prospective buyers place bids. The finalize-sale function transfer_nft transfers token ownership to an arbitrarily specified recipient but never verifies that the recipient's active bid equals the seller's listed price, and it defaults the settlement amount to zero when the recipient holds no bid. An attacker can therefore take ownership of a listed token without paying the seller, either by pointing the transfer at a bid-less address they control (possible under auto_approve) or by placing a bid and cancelling it ahead of the seller's transaction. The sponsor confirmed the issue and endorsed a fix that requires the bid amount to match the listed price before completing a trade.
Coded Estate: Cancelling bid doesn't clear token approval of bidder allows malicious bidder to steal any tokens listing for sale with auto-approve enabled
In Coded Estate's CosmWasm NFT marketplace, a seller can list a token with auto_approve enabled, which grants a bidder approval to complete a sale through transfer_nft. The bid-cancellation path in setbidtobuy removes the bid and refunds the deposit but fails to revoke the previously granted approval. An attacker can therefore bid, immediately cancel to reclaim their funds, and then call transfer_nft to receive the token ownership without making any payment, effectively stealing the listed property from the seller. The accompanying Rust test reproduces the full end-to-end theft with no balance deduction.
Coded Estate: Attakers can steal the funds from long-term reservation
In Coded Estate's NFT rental protocol, a landlord can list a token for sale with auto-approve enabled even while it is under an active long-term rental. The auto-approve flag means any address placing a bid via setbidtobuy() is automatically granted an unlimited, never-expiring approval on that NFT. An attacker exploits that approval by invoking withdrawtolandlord() to redirect most of the tenant's locked rental funds to an address they control, limited only by a check that leaves at least one month's rent in escrow. The attacker then cancels their own bid in the same flow to recover their full deposit at no cost, netting the withdrawn rental capital while depleting the tenant's balance. The root cause is that the early-landlord-withdrawal function authorizes anyone holding spender approval rather than restricting payouts to the legitimate owner, and the suggested fix narrows that authority accordingly.
All reports in this group
- Coded Estate: Users can't cancel reservation due to out-of-gasLogic error$0
- Coded Estate: `setbidtobuy` allows token purchase even when sale is no longer listedLogic error$0
- Coded Estate: Reservations can be made outside of rental property's `available_period`Logic error$0
- Coded Estate: Can impersonate another high value rental because `token_uri` is arbitrary and supplied by userLogic error$0