Collective — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Collective, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 16
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 16 closed, publicly disclosed Collective reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Reentrancy, Logic error, Integer overflow / underflow, Front-running / MEV, Signature replay, across EVM-Solidity, Move. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Reentrancy findings disclosed against Collective
- Logic error findings disclosed against Collective
- Integer overflow / underflow findings disclosed against Collective
- Front-running / MEV findings disclosed against Collective
- Signature replay findings disclosed against Collective
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Collective: Incorrect amounts of ETH are transferred to the DAO treasury in `ERC20TokenEmitter::buyToken()`, causing a value leak in every transaction
The ERC20TokenEmitter contract fails to transfer the full share of ETH to the DAO treasury during token purchases. While the contract correctly calculates the portion of funds meant for creator governance tokens, it omits this amount when performing the transfer to the treasury, leaving the funds permanently locked in the emitter contract. This logic error results in a continuous loss of protocol revenue, impacting every purchase transaction.
Collective: Since art pieces' size is not limited, attacker may block AuctionHouse from creating and settling auctions
The Collective protocol lets any user create art pieces, and the only validation enforced on the submitted metadata is that the metadata fields are non-zero. An attacker can register an art piece carrying a very large data string (roughly one megabyte of null bytes). When that piece wins voting and is processed by the AuctionHouse, the oversized, expensive-to-read state is loaded during auction creation and settlement, driving gas consumption past block limits and reverting the transactions. Because _settleAuction blocks the creation of the next auction, an attacker can repeatedly stall the entire auction cycle. The author deliberately used null bytes and a single creator to isolate the pure metadata-weight effect from other gas multipliers such as unbounded creator loops.
Collective: ERC20TokenEmitter will not work after a certain period of time
The Collective protocol's token emission mechanism is vulnerable to a denial-of-service condition due to arithmetic issues in its VRGDA (Variable Rate Gradual Dutch Auction) implementation. When significant time passes after the contract's deployment, calculations involving the time elapsed since start trigger precision loss or underflow errors within the pricing logic. This causes all token purchase attempts to revert once the time threshold is exceeded, preventing any further token distribution or participation.
Collective: Malicious delegatees can block delegators from redelegating and from sending their NFTs
The Collective protocol suffers from a critical vulnerability where a delegatee can permanently freeze a delegator's NFTs and voting power. By delegating their votes, a user inadvertently gives a malicious delegatee the ability to trigger a state-breaking operation by delegating those votes to the zero address. This action corrupts internal state management, causing all subsequent attempts by the victim to redelegate or transfer their own NFTs to revert, resulting in a total loss of access to their assets.
Collective: Since buyToken function has no slippage checking, users can get less tokens than expected when they buy tokens directly
The Collective protocol's buyToken function lacks slippage protection, exposing users to front-running attacks that result in receiving fewer tokens than anticipated. Because the protocol uses a Variable Rate Gradual Dutch Auction (VRGDA) that increases prices based on supply, front-running transactions can manipulate the token price unfavorably for subsequent buyers. This poor user experience allows attackers to ensure victims get worse exchange rates, effectively stealing value from unsuspecting users.
Collective: The quorumVotes can be bypassed
The Revolution Protocol's quorum mechanism for art pieces is vulnerable to manipulation because it calculates the required quorum using the current totalSupply of governance tokens at the moment of creation. Because the total supply can fluctuate within a single block, actors can back-run the creation transaction to influence the supply and effectively lower the quorum requirement. This allows art pieces to be dropped without reaching the protocol's intended level of community support, undermining the integrity of the DAO's governance process.
All reports in this group
- Collective: Once EntropyRateBps is set too high, can lead to denial-of-service (DoS) due to an invalid ETH amountLogic error$0
- Collective: `VerbsToken.tokenURI()` is vulnerable to JSON injection attacksLogic error$0
- Collective: positionMapping for last element in heap is not updated when extracting max elementLogic error$0
- Collective: `encodedData` argument of `hashStruct` is not calculated perfectly for EIP712 singed messages in `CultureIndex.sol`Signature replay$0
- Collective: Violation of ERC-721 Standard in VerbsToken:tokenURI ImplementationLogic error$0
- Collective: Bidder can use donations to get VerbsToken from auction that already endedGovernance attack$0
- Collective: MaxHeap.sol: Already extracted tokenId may be extracted againLogic error$0
- Collective: Anyone can pause AuctionHouse in `_createAuction`Reentrancy$0
- Collective: `ERC20TokenEmitter::buyToken` function mints more tokens to users than it should doReentrancy$0
- Collective: `ArtPiece.totalVotesSupply` and `ArtPiece.quorumVotes` are incorrectly calculated due to inclusion of the inaccessible voting powers of the NFT that is being auctioned at the moment when an art piece is createdGovernance attack$0