DittoETH — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for DittoETH, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 3
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 3 closed, publicly disclosed DittoETH reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against DittoETH
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
DittoETH: An attacker can mint free DUSD and liquidate the corresponding Short Record to earn liquidation rewards
In DittoETH's short-order lifecycle, an attacker who creates a Short Order with a collateral ratio below 1 can exploit the interplay between decreaseCollateral() and cancelShort() to mint DUSD with insufficient ETH backing, then liquidate the resulting bad-debt Short Record for liquidation rewards. When a sub-1-CR Short Order is created, the protocol pre-fills collateral into the Short Record to cover minShortErc; by first withdrawing that collateral via decreaseCollateral() and then cancelling the short, the attacker triggers the cancelShort() logic that virtually mints the minShortErc debt top-up, effectively creating free DUSD. The sponsor confirmed the finding and plans to fix it by checking the resulting collateral ratio in decreaseCollateral().
DittoETH: The `shortOrder` verification bug on the `RedemptionFacet::proposeRedemption()` allows an attacker to leave a small `shortOrder` on the order book, leading to the protocol's bad debt
DittoETH's RedemptionFacet.proposeRedemption() has a validation-ordering flaw: it loads a short order using the caller-supplied shortOrderId but only verifies that the order actually belongs to the shortRecord being redeemed inside the branch that triggers when the order's ercAmount is below the minShortErc threshold. By pointing shortOrderId at a larger, unrelated order, an attacker can dodge the need to cancel their own under-threshold short order when their shortRecord is redeemed. The surviving small short order, once matched, produces an undersized short position that liquidators lack incentive to close and that the redemption mechanism will not redeem, leaving bad debt on the protocol.
DittoETH: If a redemption has `N` disputable shorts, it is possible to dispute `N-1` times the redemption to maximize the penalty
DittoETH's Redemption mechanism allows anyone to redeem dUSD by closing out shorts with very poor collateral ratios, and lets a disputer penalize a redeemer who proposes a misordered (non lowest-CR-first) set of shorts. The flaw is that a single bad proposal can be disputed once per invalid short instead of all at once, and the penalty is recomputed per disputed short using the CR gap between the proof short and each disputed short. Disputing the shorts one-by-one stacks the penalties, yielding a materially larger total penalty (0.447 ETH) than a single all-at-once dispute (0.273 ETH). This over-penalizes the redeemer and over-rewards the disputer, distorting redemption incentives but not exposing core user funds to theft. The recommended fix is to reject a dispute when the next-lower proposal short is still below the provided proof CR.