DittoETH — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for DittoETH, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 20
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 20 closed, publicly disclosed DittoETH reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Access control, Oracle manipulation, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against DittoETH
- Access control findings disclosed against DittoETH
- Oracle manipulation findings disclosed against DittoETH
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
DittoETH: An attacker can mint free DUSD and liquidate the corresponding Short Record to earn liquidation rewards
In DittoETH's short-order lifecycle, an attacker who creates a Short Order with a collateral ratio below 1 can exploit the interplay between decreaseCollateral() and cancelShort() to mint DUSD with insufficient ETH backing, then liquidate the resulting bad-debt Short Record for liquidation rewards. When a sub-1-CR Short Order is created, the protocol pre-fills collateral into the Short Record to cover minShortErc; by first withdrawing that collateral via decreaseCollateral() and then cancelling the short, the attacker triggers the cancelShort() logic that virtually mints the minShortErc debt top-up, effectively creating free DUSD. The sponsor confirmed the finding and plans to fix it by checking the resulting collateral ratio in decreaseCollateral().
DittoETH: Users can evade the `yDUSD` vault's withdrawal timelock mechanism
DittoETH's yDUSD rebasing vault enforces a per-account 7-day withdrawal timelock through a proposeWithdraw mechanism stored in a withdrawals mapping. The withdraw() function reads the elapsed-proposal timestamp from withdrawals[msg.sender] to pass the wait check, but then burns and transfers shares/assets from a separately supplied 'owner' argument, with no requirement that msg.sender and owner match. An attacker who controls a second approved account whose proposal has already elapsed can therefore drain their own owner-account vault position immediately, bypassing the timelock and breaking the invariant that funds cannot leave before the wait period. The sponsor confirmed and the judge rated this Medium, recommending a guard enforcing msg.sender == owner.
DittoETH: Attacker can profit from discount fees
In DittoETH, the discount-penalty path in _matchIsDiscounted mints dUSD to the yDUSD vault as a 0.1% penalty on the entire system ercDebt, rather than on the volume actually traded at a discount. An attacker holding vault shares can place a heavily discounted order that crosses the threshold with a small size, so the minted fee (0.001*ercDebt) dwarfs the trade loss (0.0005*ercDebt/k), guaranteeing profit once k exceeds 0.5 (i.e. after about two days). Dilution is ineffective because the minted dUSD accrues to existing pro-rata shares regardless of later deposits. The judge ran the warden's Foundry PoC showing a $20,454.54 profit at only $4,545.46 loss, confirmed the finding as High, and the sponsor acknowledged it as valid.
DittoETH: Incorrect accounting bug of the `yDUSD` vault leads to total loss of depositors' `DUSD` assets
DittoETH's yDUSD is an ERC4626-compliant yield vault whose share accounting can be permanently corrupted by the protocol's own discount-minting routine. When a market match executes below the oracle price, _matchIsDiscounted() mints a DUSD discount (newDebt) directly to the vault's balance, which raises totalAssets but leaves the tracked totalSupply (shares) untouched. If a user deposits into the vault after such a mint — most severely when the vault starts empty — ERC4626's _convertToShares() rounds assets * 1 / newDebt down to zero shares, so the user's full principal is transferred in while zero shares are minted. Because the depositor holds no shares, subsequent withdrawals revert with ERC4626WithdrawMoreThanMax and maxWithdraw returns zero, permanently locking the deposited assets. The sponsor acknowledged the finding, and the recommended mitigation is an xERC4626-style single-sided auto-compounding design that tracks balances via internal accounting rather than the raw spot balance.
DittoETH: `DUSD` assets can be minted with less `ETH` collateral than required
DittoETH's short-order cancellation path lets users mint DUSD against less ETH collateral than the protocol requires. When a partially filled short record, cancelled via OrdersFacet.cancelShort(), sits below the minimum debt, LibOrders.cancelShort() tops its ercDebt up to minShortErc and deducts a collateralDiff computed from the possibly-stale shortOrder.price and the order's collateral ratio, which may fall below 100%. Because that computed collateral value can understate what the minted DUSD is worth, a user can create free DUSD and can even leave a liquidatable under-collateralized position. This is a recurrence of a prior Code4rena audit issue (H-03) that was not fully fixed, and the sponsor confirmed the finding via the duplicate issue.
DittoETH: Flawed if check causes inaccurate tracking of the protocol's `ercDebt` and collateral
DittoETH's RedemptionFacet contains an authorization flaw in claimRemainingCollateral(): the guard that should restrict a caller to their own proposal uses the conjunction && where a disjunction || is required. Because the check only reverts when both the owner and the shortId mismatch, a shorter holding multiple shortRecords can claim collateral and delete a shortRecord whose redemption was proposed by a different redeemer whose dispute window has not yet elapsed. That prematurely deleted shortRecord can still be disputed, and disputeRedemption() re-credits the collateral and ercDebt back onto the deleted record while incrementing the asset's aggregate balances, permanently decoupling Asset.ercDebt and dethCollateral from the sum over live shortRecords. Since those aggregates feed core protocol calculations, the accounting corruption is economically significant.
All reports in this group
- DittoETH: A successfully disputed redemption proposal has still increased the redemption fee base rate; exploit to depeg dUSDLogic error$0
- DittoETH: `ShortOrders` can be created with `ercAmount == minAskEth/2`, increasing the gas costs for matching large orders and disincentivizing liquidators from liquidating themLogic error$0
- DittoETH: Users can mint DUSD with less collateral than required, which gives them free DUSD and may open a liquidatable positionLogic error$0
- DittoETH: Valid redemption proposals can be disputed when bad debt occurs by applying it to a SR outside of the proposalLogic error$0
- DittoETH: An attacker can cancel other people's short ordersLogic error$0
- DittoETH: If a redemption has `N` disputable shorts, it is possible to dispute `N-1` times the redemption to maximize the penaltyLogic error$0
- DittoETH: `transferShortRecord`: Can transfer a newly created `ShortRecord` using a previously minted NFTAccess control$0
- DittoETH: `oracleCircuitBreaker`: Not checking if price information of asset is staleOracle manipulation$0
- DittoETH: The `shortOrder` verification bug on the `RedemptionFacet::proposeRedemption()` allows an attacker to leave a small `shortOrder` on the order book, leading to the protocol's bad debtLogic error$0
- DittoETH: The `colRedeemed` variable is wrongly retrieved in `LibBytes::readProposalData` functionLogic error$0
- DittoETH: Can manipulate the `C.SHORT_STARTING_ID` `ShortRecord` of the `TAPP`Logic error$0
- DittoETH: Closing a SR during a wrong redemption proposal leads to loss of fundsLogic error$0
- DittoETH: Valid redemption proposals can be disputed by decreasing collateralLogic error$0
- DittoETH: Partially filled Short Records created without a short order cannot be liquidated and exitedLogic error$0