DYAD — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for DYAD, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 19
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 19 closed, publicly disclosed DYAD reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Oracle manipulation, Flash loan attack, Front-running / MEV, across EVM-Solidity, Move. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against DYAD
- Oracle manipulation findings disclosed against DYAD
- Flash loan attack findings disclosed against DYAD
- Front-running / MEV findings disclosed against DYAD
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
DYAD: `setUnboundedKerosineVault` not called during deployment, causing reverts when querying for Kerosene value after adding it as a Kerosene vault
The DYAD V2 deployment script failed to initialize a critical reference between the bounded and unbounded Kerosene vaults, leading to a state where price calculations for Kerosene collateral always revert. This renders any dNFTs using the bounded Kerosene vault unusable for lending operations. The issue stems from the missing invocation of `setUnboundedKerosineVault` during the system setup process, effectively breaking the valuation mechanism required for collateral health monitoring.
DYAD: `VaultManagerV2.sol::burnDyad` function is missing an `isDNftOwner` modifier, allowing a user to burn another user's minted DYAD
The `burnDyad` function in `VaultManagerV2.sol` lacks an ownership check for the provided DNft ID, allowing any user with a valid DNft to burn DYAD debt associated with another user's position. An attacker can use this to clear another user's debt balance without their consent, potentially leading to protocol-level debt inconsistencies or enabling the attacker to bypass collateral liquidation protections. This access control failure directly compromises the integrity of user debt accounting within the DYAD lending protocol.
DYAD: Design flaw and mismanagement in vault licensing leads to double counting in collateral ratios and positions collateralized entirely with kerosine
DYAD suffered from a critical collateral accounting flaw where WETH vaults were incorrectly licensed in both the standard and Kerosene managers. This configuration allowed users to add the same WETH vault to their account in two separate mappings, causing the protocol to double-count the deposited collateral during ratio calculations. This exploit enabled users to mint excess DYAD stablecoins and prevented their positions from being liquidated even when they were technically under-collateralized. This design error significantly threatened the protocol's solvency by undermining its core collateralization mechanics.
DYAD: Incorrect deployment/missing contract will break functionality
The DYAD protocol contains a fundamental design flaw in its kerosene pricing and management system, preventing core functionality. The system uses a single KeroseneManager contract to store authorized vaults, but this registry is required to hold two mutually exclusive sets of vaults. Including kerosene-accepting vaults causes an infinite recursion error during price calculation, while excluding them breaks the authorization logic in VaultManagerV2. This design contradiction effectively disables the protocol's ability to properly account for and value kerosene assets.
DYAD: Kerosene collateral is not being moved on liquidation, exposing liquidators to loss
The DYAD protocol contains a flaw in its liquidation mechanism where Kerosene collateral is ignored during the asset transfer process. When a position reaches a 100% collateral ratio and is liquidated, the protocol correctly burns the required DYAD but fails to move the Kerosene assets to the liquidator. This causes financial loss to the liquidator, who receives incomplete collateral, and allows the liquidated user to improperly retain their Kerosene tokens.
DYAD: Unable to withdraw Kerosene from `vaultmanagerv2::withdraw` as it expects a `vault.oracle()` method which is missing in Kerosene vaults
The DYAD protocol's VaultManagerV2 contract contains a flaw that prevents users from withdrawing deposited Kerosene collateral. The withdraw function is designed to interact with both standard collateral vaults and Kerosene vaults, but it incorrectly assumes all vaults possess an oracle() method. Since the Kerosene vault contracts lack this method, any attempt to initiate a withdrawal for these assets triggers an immediate transaction revert. This results in a permanent denial of access to the deposited collateral for all users.
All reports in this group
- DYAD: Attacker can make `0` value `deposit()` calls to deny user from redeeming or withdrawing collateralOracle manipulation$0
- DYAD: Liquidating positions with bounded Kerosen could be unprofitable for liquidatorsLogic error$0
- DYAD: Inability to perform partial liquidations allows huge positions to accrue bad debt in the systemFlash loan attack$0
- DYAD: No incentive to liquidate when `CR <= 1` as asset received `<` dyad burnedLogic error$0
- DYAD: No incentive to liquidate small positions could result in protocol going underwaterLogic error$0
- DYAD: Attacker can frontrun user's withdrawals to make them revert without costsFlash loan attack$0
- DYAD: Missing enough exogenous collateral check in `VaultManagerV2::liquidate` makes the liquidation revert even if (DYAD Minted `>` Non Kerosene Value)Oracle manipulation$0
- DYAD: Users can get their Kerosene stuck until TVL becomes greater than Dyad's supplyLogic error$0
- DYAD: Liquidation bonus logic is wrongOracle manipulation$0
- DYAD: Attacker can frontrun to prevent vaults from being removed from the dNFT owner's positionFront-running / MEV$0
- DYAD: Flash loan protection mechanism can be bypassed via self-liquidationsLogic error$0
- DYAD: User can get their Kerosene stuck because of an invalid check on withdrawOracle manipulation$0
- DYAD: Value of kerosene can be manipulated to force liquidate usersOracle manipulation$0