Index Fun Order Book — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Index Fun Order Book, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 3
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 3 closed, publicly disclosed Index Fun Order Book reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Index Fun Order Book
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Index Fun Order Book: Seller Pays Buyer's Trade Fee in Token Swaps, Leading to Systematic Theft of Funds
In the Index Fun Order Book, the token-swap settlement path (`_executeTokenSwap` and `_executeAgainstMatcher`) charges the buyer's trade fee out of the seller's payment proceeds instead of as an additional cost to the buyer. Because the fee rate is the buyer's effective trade-fee rate, a buyer with a high configured fee causes the seller to absorb that fee in the net payment transferred. This systematically drains sellers and market makers in every token-swap fill, and creates a perverse incentive for buyers to prefer swaps over JIT minting where fees are charged additively. The protocol team acknowledged and fixed the issue via PR.
Index Fun Order Book: Lack of Emergency Market Invalidation Mechanism
Index Fun Order Book is a prediction-market protocol where users lock collateral in a Vault against the outcome of real-world events, resolved through an off-chain oracle that provides a Merkle root. The protocol only exposes resolution paths that require a valid merkleRoot, and there is no mechanism to mark a market as invalidated or canceled. If the real-world event is canceled, ambiguous, or the off-chain resolution source fails permanently, no valid merkle root can be produced, leaving the condition unresolved and the claimWinnings path reverting. As a result, all participants' locked collateral becomes irrecoverably stuck, since neither the protocol owner nor the emergency resolver can unilaterally intervene to refund funds.
Index Fun Order Book: Emergency resolver targets wrong epoch
The market controller's emergency resolution function reads the live currentEpoch from the market contract at call time and resolves that epoch, rather than letting the caller designate which closed epoch to finalize. In time-based daily and weekly markets, getCurrentEpoch automatically rolls forward to the active trading window once a period ends, so an authorized matcher who invokes the emergency path after a roll quietly resolves the new epoch while the previous one is permanently skipped. This leaves prior winners unable to claim and locks the new epoch to an incorrect merkle root, a gap the protocol fixed by adding an explicit epoch parameter with bounds checks.