Collective — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Collective, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 18
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 18 closed, publicly disclosed Collective reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Reentrancy, Signature replay, Governance attack, Integer overflow / underflow, across EVM-Solidity, Move. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Collective
- Reentrancy findings disclosed against Collective
- Signature replay findings disclosed against Collective
- Governance attack findings disclosed against Collective
- Integer overflow / underflow findings disclosed against Collective
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Collective: Since art pieces' size is not limited, attacker may block AuctionHouse from creating and settling auctions
The Collective protocol lets any user create art pieces, and the only validation enforced on the submitted metadata is that the metadata fields are non-zero. An attacker can register an art piece carrying a very large data string (roughly one megabyte of null bytes). When that piece wins voting and is processed by the AuctionHouse, the oversized, expensive-to-read state is loaded during auction creation and settlement, driving gas consumption past block limits and reverting the transactions. Because _settleAuction blocks the creation of the next auction, an attacker can repeatedly stall the entire auction cycle. The author deliberately used null bytes and a single creator to isolate the pure metadata-weight effect from other gas multipliers such as unbounded creator loops.
Collective: Incorrect amounts of ETH are transferred to the DAO treasury in `ERC20TokenEmitter::buyToken()`, causing a value leak in every transaction
The ERC20TokenEmitter contract fails to transfer the full share of ETH to the DAO treasury during token purchases. While the contract correctly calculates the portion of funds meant for creator governance tokens, it omits this amount when performing the transfer to the treasury, leaving the funds permanently locked in the emitter contract. This logic error results in a continuous loss of protocol revenue, impacting every purchase transaction.
Collective: `encodedData` argument of `hashStruct` is not calculated perfectly for EIP712 singed messages in `CultureIndex.sol`
The protocol incorrectly implements EIP-712 message signing for structures containing dynamic arrays. Specifically, the `CultureIndex` contract performs improper encoding of the `pieceIds` array, failing to hash its contents as required by the EIP-712 specification. This discrepancy between off-chain signature generation and on-chain verification causes valid user signatures to be rejected, effectively breaking the voting mechanism.
Collective: `ArtPiece.totalVotesSupply` and `ArtPiece.quorumVotes` are incorrectly calculated due to inclusion of the inaccessible voting powers of the NFT that is being auctioned at the moment when an art piece is created
The CultureIndex contract incorrectly calculates the quorum requirements for art pieces by including voting power from tokens that are currently held in the AuctionHouse contract. Because these tokens are locked and ineligible for voting, the system essentially sets a higher-than-necessary quorum, effectively increasing the difficulty for art pieces to proceed to auction. This logic error unfairly biases the governance process by creating an inflated and unreachable voting supply threshold.
Collective: `CultureIndex.sol#dropTopVotedPiece()` - Malicious user can manipulate topVotedPiece to DoS the whole CultureIndex and AuctionHouse
Revolution Protocol's CultureIndex caches each art piece's required voting quorum (quorumVotes) from the voting token's total supply at the moment the piece is created. Because dropTopVotedPiece() reverts whenever the top-weighted piece in the vote-weight max-heap has not yet reached its cached quorum, an actor who buys voting tokens to inflate supply — or simply ordinary supply growth — can create a bogus piece with an inflated quorum and vote it to the heap top without meeting that quorum. The wedged heap top then blocks the whole AuctionHouse drop/auction pipeline, so lower-voted quorum-eligible pieces can never be auctioned, and users are forced to waste gas pushing the unwanted piece past quorum (and endure its auction) or to abandon and re-create their pieces. The judge upheld the report at Medium severity, noting the stuck state can also arise naturally and there is no clean in-contract remedy.
Collective: MaxHeap.sol: Already extracted tokenId may be extracted again
The protocol's MaxHeap implementation fails to properly clear storage when an element is removed, leaving 'dirty' data in the array. During subsequent heap operations, the maxHeapify function may incorrectly read this stale data, leading to the erroneous retrieval of already-extracted items. This bug compromises the integrity of the heap, potentially affecting any protocol logic that relies on the heap's ordering or state.
All reports in this group
- Collective: Malicious delegatees can block delegators from redelegating and from sending their NFTsInteger overflow/underflow$0
- Collective: It may be possible to DoS AuctionHouse by specifying malicious creatorsGovernance attack$0
- Collective: `VerbsToken.tokenURI()` is vulnerable to JSON injection attacksLogic error$0
- Collective: Anyone can pause AuctionHouse in `_createAuction`Reentrancy$0
- Collective: The quorumVotes can be bypassedReentrancy$0
- Collective: ERC20TokenEmitter will not work after a certain period of timeInteger overflow/underflow$0
- Collective: Since buyToken function has no slippage checking, users can get less tokens than expected when they buy tokens directlyFront-running / MEV$0
- Collective: Bidder can use donations to get VerbsToken from auction that already endedGovernance attack$0
- Collective: `ERC20TokenEmitter::buyToken` function mints more tokens to users than it should doReentrancy$0
- Collective: Once EntropyRateBps is set too high, can lead to denial-of-service (DoS) due to an invalid ETH amountLogic error$0
- Collective: positionMapping for last element in heap is not updated when extracting max elementLogic error$0
- Collective: Violation of ERC-721 Standard in VerbsToken:tokenURI ImplementationLogic error$0