Convergence Convex Integration — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Convergence Convex Integration, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 3
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 3 closed, publicly disclosed Convergence Convex Integration reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Convergence Convex Integration
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Convergence Convex Integration: Users will not be able to claim their their CVX rewards under certain conditions
In the Convergence CVG/CVX staking integration, the reward claim path can permanently block users from withdrawing their accrued CVG and Convex rewards. When the protocol-wide MAX_STAKING mint cap is reached, the strict require in CVG.mintStaking reverts the entire transaction chain originating in StakingService.claimCvgCvxRewards, so a user with unclaimed CVG cannot claim either the CVG or the Convex rewards. The reporter recommends removing the blocking require and letting the existing capping logic mint zero CVG while still allowing the Convex rewards payout, and notes the boundary state creates a front-running/race incentive near the cap.
Convergence Convex Integration: CvxAssetStakerBuffer.sol#pullRewards() - If the `cvsAssetWrapper` is shutdown, `pullRewards` will revert every time and the rewards cannot be distributed to the `rewardReceiver`
Convergence's CvxAssetStakerBuffer pulls Convex staking rewards through pullRewards, which first invokes stakeAllCvxAsset to re-stake the entire cvxAsset balance before calling getReward. If the underlying Convex wrapper has its isShutdown flag set, stake permanently reverts even though getReward remains allowed, so pullRewards fails every time and accumulated rewards can never be forwarded to the reward receiver. The failure is reliably triggerable by any address dusting the buffer with a single wei of cvxAsset, forcing the stake call to execute. This bricks reward distribution for all users and strands any cvxAsset balance in the contract, matching the reporter's medium severity assessment of low likelihood but high impact.
Convergence Convex Integration: User looses StakeDao rewards, if he misses to call `claimCvgCvxRewards` for cycle
Convergence's Convex staking service contains a reward-accounting bug in `_claimCvgCvxRewards` where the number of reward tokens iterated during a claim is derived from the cycle number of the user's last interaction (`nextClaimableCvx`) rather than from the actual count of registered reward tokens. As new Stake DAO / CVX reward tokens are registered in later cycles with incrementing ids, a user who skips claiming for several cycles only receives the first registered token for all missed cycles. Because the user's stake continues to count toward reward-share computations across those cycles, the skipped tokens are never distributable and remain permanently locked in the contract, and the claim pointer is advanced past them as if they were paid out.