Current Finance — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Current Finance, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 6
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 6 closed, publicly disclosed Current Finance reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Integer overflow / underflow, Logic error, across Move. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Integer overflow / underflow findings disclosed against Current Finance
- Logic error findings disclosed against Current Finance
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Current Finance: Multiply-before-divide overflow in update_pool_reward_manager permanently freezes all lending operations for affected CoinType
A high-severity arithmetic overflow in Current Finance's reward manager permanently freezes all lending operations for a given CoinType on Sui. The bug is a multiply-before-divide in the reward unlock calculation: `total_rewards * time_passed` overflows the decimal-safe bound before the normalization by the reward duration is applied, aborting every transaction. With realistic reward configurations (e.g., 500K USDC over 30 days), just ~10 hours of pool inactivity triggers the abort, and since the update timestamp never advances, the pool enters an irrecoverable deadlock blocking deposits, withdrawals, borrows, repays, liquidations and reward claims, risking bad-debt accumulation and loss of user funds.
Current Finance: Double subtraction of cash_reserve in deposit_limit_breached allows bypassing the maximum deposit limit
Current Finance's Sui Move lending market enforces a per-asset maximum deposit cap through the deposit_limit_breached guard, but that guard subtracts cash_reserve twice when computing the current pool size. Because total_deposit_plus_interest already reduces the pool to the users' pure stake (cash + debt - cash_reserve), the extra subtraction deflates the measured deposit total by the size of the accrued reserve. As a result, deposits that would push real user deposits above the configured max_deposit_amount are accepted, and the cap becomes progressively ineffective as protocol fees accumulate, weakening the market's risk-management invariant on deposit sizing.
Current Finance: Cross-segment limiter netting failure lets attackers grief daily borrow and withdraw caps
Current Finance's market limiter is meant to enforce a rolling net-outflow cap on borrowing and withdrawals, storing usage in per-segment buckets. However, while adding outflow charges the current segment, reducing outflow (repayments or redeposits) only mutates the current segment and total usage sums all live segments in the window. As a result, an outflow recorded near the end of one segment cannot be unwound in a later segment, so the earlier bucket stays fully charged for the rest of the cycle. An attacker can borrow or withdraw right before a segment boundary, unwind right after the next segment starts, and leave the cap saturated at no residual capital risk. This griefs legitimate users by blocking borrows and withdrawals, an availability impact the assigned medium severity reflects.
Current Finance: Expired reward pool close can refund economically accrued borrower yield before lazy reward materialization
Current Finance's Sui-based lending protocol has a lifecycle flaw in closing expired borrow liquidity-mining pools. Because new reward pools are created with zero per-borrower trackers and those trackers are materialized lazily (only on the borrower's next interaction or claim), a borrower who deposited before the campaign can accrue rewards through the global total_shares and cumulative_rewards_per_share math while never appearing in the pool's num_obligation_reward_managers counter. The close_pool_reward path gates refunds on that counter being zero without first refreshing the pool, so closing an expired pool refunds the full remaining balance to the close caller even though the normal claim path would have paid the same value to the borrower. After the close, the borrower's later claim fails, making the reward permanently lost. A Move PoC demonstrates economic equivalence between the control (claim-first) and exploit (close-first) paths, proving the refund is the borrower's accrued yield, not campaign dust.
Current Finance: ADL borrow deleverage triggers on global debt instead of per-group debt, force-liquidating healthy positions
Current Finance's auto-deleveraging (ADL) logic triggers on the total borrow of a coin across all emode groups instead of the debt of the specific group being liquidated. The start check at market.move:580 compares reserve.debt() against the configured target, while the stop check at L686 already uses the correct emode_group.borrow_amount(). This lets an ADL liquidator force-liquidate healthy borrowers whose own group's debt is below the ADL threshold, seizing collateral at a discount, and because the checks disagree it re-arms each time so positions get picked off repeatedly until the cross-group global debt falls below target. It is a lending protocol logic/accounting error on Sui.
Current Finance: Whitelisted liquidation bots will seize collateral from borrowers that are still solvent at spot price during EMA lag
Current Finance's Sui lending market judges liquidation eligibility with the EMA oracle price but computes collateral seizure using the spot price, while its own borrow/withdraw health checks reject EMA/spot divergence beyond a 10% per-asset tolerance. Because the two oracle modes are inconsistent, a whitelisted liquidation bot can liquidate a position that is still solvent at the current spot price during a fast price recovery, seizing collateral the borrower should keep. The borrower loses roughly the repaid debt times the liquidation incentive, an avoidable loss of about $16,250 in the report's near-threshold $1,000,000/$650,000 worked example. The root cause is confirmed end-to-end by a two-test Move PoC showing the borrower defense reverting under the same divergence while the liquidation path succeeds.