DYAD — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for DYAD, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 15
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 15 closed, publicly disclosed DYAD reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Oracle manipulation, Flash loan attack, Logic error, Front-running / MEV, across Move, EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Oracle manipulation findings disclosed against DYAD
- Flash loan attack findings disclosed against DYAD
- Logic error findings disclosed against DYAD
- Front-running / MEV findings disclosed against DYAD
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
DYAD: Liquidation bonus logic is wrong
The DYAD protocol contains a flawed liquidation incentive mechanism that prevents the protocol from functioning as intended. Instead of rewarding liquidators with 20% of the debt amount they repay, the contract erroneously calculates the bonus based on the liquidated user's equity. This results in inadequate compensation for liquidators, effectively removing the economic incentive required to maintain the system's collateralization requirements. Because liquidation is no longer profitable, the system risks becoming permanently undercollateralized during market downturns.
DYAD: Unable to withdraw Kerosene from `vaultmanagerv2::withdraw` as it expects a `vault.oracle()` method which is missing in Kerosene vaults
The DYAD protocol's VaultManagerV2 contract contains a flaw that prevents users from withdrawing deposited Kerosene collateral. The withdraw function is designed to interact with both standard collateral vaults and Kerosene vaults, but it incorrectly assumes all vaults possess an oracle() method. Since the Kerosene vault contracts lack this method, any attempt to initiate a withdrawal for these assets triggers an immediate transaction revert. This results in a permanent denial of access to the deposited collateral for all users.
DYAD: Attacker can make `0` value `deposit()` calls to deny user from redeeming or withdrawing collateral
The VaultManagerV2 contract contains an access control vulnerability that allows any user to perform actions on behalf of another user's collateral NFT. Because the deposit function uses an existence check rather than an ownership check, an attacker can intentionally trigger a deposit for any NFT ID. This allows an attacker to frontrun a victim's withdrawal or redemption transaction by updating the 'last deposit block' to the current block. As a result, the victim's attempt to withdraw or redeem is forced to revert, effectively locking them out of their assets.
DYAD: Attacker can frontrun user's withdrawals to make them revert without costs
The DYAD protocol contains a Denial of Service (DoS) vulnerability in its VaultManagerV2 contract that allows attackers to block users from withdrawing their funds. The issue stems from the deposit function, which updates a 'last deposit block' state for a given dNft ID regardless of whether the target vault is legitimate or authorized. An attacker can front-run a user's withdrawal transaction by depositing into a fake vault, causing the user's transaction to revert due to the protocol's flash-loan protection check. This allows an attacker to continuously grief users by preventing them from accessing their assets without incurring any significant costs.
DYAD: Value of kerosene can be manipulated to force liquidate users
The DYAD protocol calculates the price of kerosene tokens based on the real-time difference between total collateral and minted debt. Because this valuation depends directly on the protocol's current TVL, large deposits or withdrawals by liquidity providers can cause sudden, significant fluctuations in the price of kerosene. This vulnerability allows malicious users to manipulate the collateralization ratios of other users, potentially forcing them into involuntary liquidations by strategically withdrawing capital to drop the token's price.
DYAD: `VaultManagerV2.sol::burnDyad` function is missing an `isDNftOwner` modifier, allowing a user to burn another user's minted DYAD
The `burnDyad` function in `VaultManagerV2.sol` lacks an ownership check for the provided DNft ID, allowing any user with a valid DNft to burn DYAD debt associated with another user's position. An attacker can use this to clear another user's debt balance without their consent, potentially leading to protocol-level debt inconsistencies or enabling the attacker to bypass collateral liquidation protections. This access control failure directly compromises the integrity of user debt accounting within the DYAD lending protocol.
All reports in this group
- DYAD: `setUnboundedKerosineVault` not called during deployment, causing reverts when querying for Kerosene value after adding it as a Kerosene vaultLogic error$0
- DYAD: User can get their Kerosene stuck because of an invalid check on withdrawOracle manipulation$0
- DYAD: Design flaw and mismanagement in vault licensing leads to double counting in collateral ratios and positions collateralized entirely with kerosineOracle manipulation$0
- DYAD: Missing enough exogenous collateral check in `VaultManagerV2::liquidate` makes the liquidation revert even if (DYAD Minted `>` Non Kerosene Value)Oracle manipulation$0
- DYAD: Attacker can frontrun to prevent vaults from being removed from the dNFT owner's positionFront-running / MEV$0
- DYAD: Incorrect deployment/missing contract will break functionalityLogic error$0
- DYAD: No incentive to liquidate small positions could result in protocol going underwaterLogic error$0
- DYAD: Kerosene collateral is not being moved on liquidation, exposing liquidators to lossOracle manipulation$0
- DYAD: Inability to perform partial liquidations allows huge positions to accrue bad debt in the systemFlash loan attack$0