Debita Finance V3 — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Debita Finance V3, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 3
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 3 closed, publicly disclosed Debita Finance V3 reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Debita Finance V3
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Debita Finance V3: Borrower can obtain principle tokens without paying collateral tokens
Debita Finance V3's order-matching aggregator computes the collateral a borrower must post using integer division that rounds down. When the principal token has more decimals than the collateral token (e.g. 18 vs 6), a borrower can set each lendOrder's lendAmountPerOrder below the rounding threshold, causing the collateral required to round to zero. Because matchOffersV3 is permissionless and can process up to 100 lend orders per transaction, and the protocol targets cheap L2 chains, an attacker can repeatedly extract principal tokens with no collateral backing, producing guaranteed losses for lenders. The protocol team confirmed and fixed the issue.
Debita Finance V3: Auctioned `taxTokensReceipt` NFT Blocks Last Claimant Due to Insufficient Funds
Debita Finance V3's auction contract lets a buyer purchase an auctioned collateral NFT (a taxTokensReceipt wrapping a fee-on-transfer token) using the same FoT token, but the payment transfer does not account for the token's transfer fee. The loan contract consequently receives less than the recorded auction price, and handleAuctionSell computes an inflated per-unit collateral share for the remaining lenders. When the lenders later attempt to claim their shares, the final claimant reverts for insufficient funds, effectively locking a portion of the collateral in the contract.
Debita Finance V3: Nobody can buy the `TaxTokenReceipt` NFT from auction
Debita Finance V3 overrides the ERC721 transferFrom function on its TaxTokenReceipt NFT so that transfers are only permitted when the sender or receiver is a BorrowOrder, LendOrder, or Loan contract. This restriction is satisfied during order matching and auction setup, but once collateralizing NFT is escrowed inside the Auction contract to be sold, neither the Auction contract nor the buyer's address qualifies as one of those Debita entities. As a result, the required check fails and no one can purchase the NFT from the auction, permanently freezing the underlying collateral tokens and guaranteeing a total loss for lenders while the borrower keeps the borrowed principal.