Illuminex — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Illuminex, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Illuminex reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Bridge exploit, Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Bridge exploit findings disclosed against Illuminex
- Logic error findings disclosed against Illuminex
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Illuminex: A malicious/ inactive relayer of VaultBitcoinWallet can make withdrawal mechanism stuck forever
Illuminex's VaultBitcoinWallet starts an outgoing Bitcoin withdrawal by having a relayer call startOutgoingTxSerializing, which deploys a fresh TxSerializer via the factory and designates that single calling relayer as its only operator. Because only that relayer can drive the serializer to its Finished state, the follow-up finaliseOutgoingTxSerializing call, while callable by anyone, reverts at the _sr.getRaw() step unless the original relayer cooperates. As a result a malicious, compromised, or merely unlucky (e.g. hardware-losing) relayer can freeze the withdrawal mechanism indefinitely with no recovery path. The finding is a design-level trust concern and the suggested fix is to transfer the serializer owner to the wallet owner instead of the relayer.
Illuminex: VaultBitcoinWallet` contract can not disable `relayersWhitelist` via `toggleRelayersWhitelistEnabled()` function
Illuminex's VaultBitcoinWallet deploys RefuelTxSerializer instances when starting refuel transaction serializing, and the factory transfers each serializer's ownership to the wallet. Because ownership is held by the wallet contract rather than an EOA, the wallet has a direct call path for toggleRelayer but no code path to invoke the inherited onlyOwner toggleRelayersWhitelistEnabled function on its deployed serializers. This permanently prevents enabling or disabling the relayer whitelist flag that gates the onlyRelayer modifier across the affected contracts, leaving a core whitelist capability unusable. The proposed fix adds an owner-facing wrapper on the wallet that forwards the toggle call to a targeted serializer instance.