Ethos Network Social Contracts — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Ethos Network Social Contracts, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Ethos Network Social Contracts reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Ethos Network Social Contracts
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Ethos Network Social Contracts: Restored addresses will not be able to take any action on behalf of the profile due to still being marked as compromised
EthosProfile's compromised-address lifecycle is asymmetric: deleteAddressAtIndex() permanently sets isAddressCompromised[address] = true, but the registerAddress() restore path never clears that flag. Any address that is deleted while compromised and later restored stays flagged forever, so it is blocked from acting on behalf of its profile even though the protocol intends restored addresses to regain full privilege. The impact is a loss of functional access for a legitimately restored address rather than direct financial loss, matching the medium severity it was adjudicated at.
Ethos Network Social Contracts: Corruptible Upgradability Pattern
The Ethos Network suite of UUPS upgradeable social contracts (EthosProfile, EthosReview, EthosAttestation, EthosDiscussion, EthosVote) is deployed behind proxies, but its custom base contracts AccessControl and SignatureControl declare storage slots without storage gaps, and AccessControl additionally inherits the non-upgradeable OpenZeppelin Pausable and AccessControlEnumerable. Because proxy upgrades rely on deterministic storage layout, any future upgrade that appends a slot to these base contracts would overwrite state used by derived contracts, corrupting profile, review, attestation, or vote data. The flaw is latent — no external attacker triggers it — surfacing only during a routine administrative upgrade that adds storage. The protocol team acknowledged the finding and fixed it with a pull request adding gaps, switching to OpenZeppelin-upgradeable libraries, and disabling initializers on the implementation contracts.