INIT Capital — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for INIT Capital, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 22
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 22 closed, publicly disclosed INIT Capital reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Front-running / MEV, Access control, Logic error, Reentrancy, Oracle manipulation, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Front-running / MEV findings disclosed against INIT Capital
- Access control findings disclosed against INIT Capital
- Logic error findings disclosed against INIT Capital
- Reentrancy findings disclosed against INIT Capital
- Oracle manipulation findings disclosed against INIT Capital
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
INIT Capital: SwapType.CloseExactOut balance check too strict can be DOSed
INIT Capital's CoreCallback enforces a strict equality check on the CloseExactOut swap path, requiring the contract's post-swap tokenOut balance to exactly match the requested amount. Because the actual AMM output depends on current pool ratios, any prior trade that nudges the ratio — even slightly — makes the equality fail and reverts the entire position adjustment. An attacker front-runs legitimate swaps with small trades to repeatedly deny liquidation or position-reduction operations. The project confirmed the finding and the judge downgraded it to Medium since it is denial of service with no direct loss of funds.
INIT Capital: MarginTradingHook#updateOrder lacks access control
INIT Capital's MarginTradingHook exposes updateOrder, which lets any caller with an open margin position rewrite the trigger price, limit price, collateral amount, and output token of any other user's active order. The function checks that the target order is Active and that the caller holds a position, but never verifies that the order belongs to the caller, so credentials are not bound to the order being modified. A confirmed PoC shows Bob mutating Alice's stop-loss order by supplying Alice's order ID along with Bob's own position ID. Since these orders gate collateral and liquidation risk, an attacker can silently dismantle a victim's risk-management protection. The INIT team confirmed the finding and proposed an ownership check matching cancelOrder.
INIT Capital: `fillOrder` not properly cancel order when collateral of position is empty
INIT Capital's MarginTradingHook.fillOrder contains a memory-versus-storage write bug in its empty-position cancellation branch. When the collateral amount of the order's position is zero, the function intends to cancel the order, but it mutates the status field of a local memory copy of the Order struct rather than the storage-backed __orders entry. As a result, the storage status remains Active and the cancellation is never persisted, misleading users into believing their order was canceled. The judge rated this a Medium because order cancellation fails to work as intended, while the sponsor argued for QA given the absence of direct fund impact.
INIT Capital: LP unwrap / wrap is fully broken if master chef contract has insufficient reward token and block decollateralize wlp and wlp liquidation
The INIT Capital WLpMoeMasterChef wrapper relies on an external Trader Joe MasterChef contract that the protocol team does not control. Every deposit, withdraw, harvest and claim path calls the chef's _modify, which transfers accrued MOE rewards and forwards to the extraRewarder's onModify — both transfers revert when the respective contract holds insufficient reward tokens. Because the wrapper invokes this reward-claiming path unconditionally during LP unwrap, InitCore's decollateralize-wlp flow, and liquidation, a reward shortfall reverts the whole transaction and bricks those core lending operations. The proposed remediation is to fall back to the chef's emergencyWithdraw path, which returns LP tokens without claiming rewards, so withdrawals and liquidations can proceed. The INIT team acknowledged the finding on code4rena.
INIT Capital: MarginTradingHook users could potentially be DOSed
INIT Capital's MarginTradingHook carries a `refundNative` modifier that, after any wrapped call, withdraws the hook's entire WNATIVE balance and forwards the resulting native coins to the caller via a low-level call, gating success on `_require(success, CALL_FAILED)`. Because the refund runs unconditionally rather than only for native-related trades, any WNATIVE dust sitting on the hook balance is converted and pushed to the caller. A caller contract lacking a `receive` or payable `fallback` cannot accept the forced native transfer, so the whole transaction reverts, allowing an attacker to repeatedly deposit one-wei amounts of wrapped native tokens and deny service to those margin-trading users. The judge ruled this Medium given that no documentation told hook users to accept native tokens and that one wei of dust suffices to mount the DoS, while the sponsor had argued for QA.
INIT Capital: `fillOrder` executor can be front-run by the order creator by changing order's `limitPrice_e36`, the executor's assets can be stolen
INIT Capital's MarginTradingHook lets margin-trading order creators specify a limitPrice_e36 that bounds the token amount paid to a fill executor. Because this price field is mutable via updateOrder and directly drives the _calculateFillOrderInfo amtOut calculation, an order creator who observes an executor's fillOrder transaction can front-run it by moving limitPrice_e36 in their favor, inflating the amount transferred from the executor and stealing the executor's assets. The maintainer acknowledged the issue and committed to replacing in-place order updates with cancel-and-recreate semantics.
All reports in this group
- INIT Capital: Order's creator can update `tokenOut` to arbitrary tokenFront-running / MEV$0
- INIT Capital: `_handleRepay` of `MoneyMarketHook` does not consider the actual debt shares of the `posId` inside the position manager and could lead to a user's tokens getting stuck inside the hookFront-running / MEV$0
- INIT Capital: `collateralizeWLp` can be bypassed even when collateralization is pausedReentrancy$0
- INIT Capital: `setPosMode` should not allow changing the mode when the new mode's `canRepay` status is disabledReentrancy$0
- INIT Capital: Lack of way to handle not fully repaid bad debt after liquidation after the lending pool share or WLP are fully seizedLogic error$0
- INIT Capital: Malicious user can steal native tokens of MoneyMarketHook callerReentrancy$0
- INIT Capital: Decimals of LendingPool don't take into account the offset introduced by VIRTUAL\_SHARESLogic error$0
- INIT Capital: API3 oracle timestamp can be set to future timestamp and block API3 Oracle usage to make code revert in underflowOracle manipulation$0
- INIT Capital: repay(), liquidate() and liquidateWLp() receive shares as argument, which may revert if from approval to tx settled blocks have passedLogic error$0
- INIT Capital: `TRST-M-8` from previous audit still presentLogic error$0
- INIT Capital: wLp tokens could be stolenLogic error$0
- INIT Capital: If wLP is blacklisted, then user will not be able to withdraw itLogic error$0
- INIT Capital: Admin configuration isAllowedForCollateral(mode, pool) can be bypassed by donating asset to the pool directly and then trigger sync cash via flashloanLogic error$0
- INIT Capital: setPosMode function doesn't check if wLp is whitelistedLogic error$0
- INIT Capital: When the `returnNative` parameter is set to true in the `_params` provided to `MoneyMarketHook.execute`, it is not handled properly and could disrupt user expectationsLogic error$0
- INIT Capital: Liquidations can be prevented by frontrunning and liquidating 1 debt (or more) due to wrong assumption in POS\_MANAGERFront-running / MEV$0