Ethos Reserve — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Ethos Reserve, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 4
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 4 closed, publicly disclosed Ethos Reserve reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Access control, Reentrancy, Logic error, Front-running / MEV, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Access control findings disclosed against Ethos Reserve
- Reentrancy findings disclosed against Ethos Reserve
- Logic error findings disclosed against Ethos Reserve
- Front-running / MEV findings disclosed against Ethos Reserve
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Ethos Reserve: Rewards will be locked in LQTYStaking Contract
The Ethos Reserve protocol contains a precision loss vulnerability in the LQTYStaking contract's reward distribution logic. When the contract receives collateral rewards, it attempts to calculate the reward per staked token; however, due to integer division truncation in Solidity, small rewards fail to increment the internal tracking state. This issue is particularly severe for low-decimal collateral tokens like WBTC, leading to these fees being permanently locked in the contract instead of being distributed to users.
Ethos Reserve: User can lose up to whole stake on vault withdrawal when there are funds locked in the strategy
The ReaperVaultV2 withdrawal mechanism fails to properly handle situations where a strategy has temporarily locked funds. During such events, the vault burns the full amount of user shares before accounting for the lower-than-expected liquidity retrieved from the strategy. Because the slippage protection check is performed after the fact on an artificially reduced value, it fails to trigger, causing the user to lose a significant portion of their stake while their full share balance is permanently removed.
Ethos Reserve: `_harvestCore()` roi calculation error
The _harvestCore function within the Ethos Reserve protocol incorrectly calculates the Return on Investment (ROI) by double counting losses during strategy harvests. When a strategy incurs a loss, the function first calculates the ROI based on the decrease in total assets compared to the allocated amount, but then erroneously subtracts the loss value again after a liquidation process. This miscalculation corrupts internal accounting data used by the vault, potentially leading to inaccurate reporting and incorrect debt management decisions.
Ethos Reserve: In `ReaperVaultV2`, we should update `lockedProfit` and `lastReport` before changing `lockedProfitDegradation`
The ReaperVaultV2 contract contains a vulnerability where administrative updates to the locked profit degradation parameter do not synchronize the contract's accounting state. Because the calculation of unlocked profits retrospectively applies new parameters to historical time, an attacker can front-run the administrative transaction to force a sudden release of locked funds. This results in the attacker capturing a disproportionate share of yield that should have remained locked, effectively siphoning value from existing depositors.