Inverse Finance - Junior Tranche — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Inverse Finance - Junior Tranche, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Inverse Finance - Junior Tranche reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Inverse Finance - Junior Tranche
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Inverse Finance - Junior Tranche: ERC4626 maxDeposit() Violates Standard by Not Enforcing Actual Deposit Limits
The jDola ERC-4626 tokenized vault in the Inverse Finance Junior Tranche inherits Solmate's default maxDeposit(), which always returns type(uint256).max rather than the true maximum the vault can accept. The vault actually enforces hard caps through MIN_SHARES, MAX_SHARES and MIN_ASSETS checks inside afterDeposit(), so maxDeposit() reports unlimited while deposits near those limits revert. This violates the ERC-4626 MUST requirement that maxDeposit() report a value no higher than the actual accepted maximum, which breaks downstream integrators that size deposits from the return value. The practical impact is failed deposits and broken ERC-4626 composability rather than direct fund theft.
Inverse Finance - Junior Tranche: Off-by-one error in exit window check allows users to avoid the withdrawal fee
Inverse Finance's junior tranche withdrawal escrow applies a full fee to a user's entire queued withdrawal once their exit window has begun, but the boundary check uses a strict greater-than comparison. A renewal executed at the exact exit-window start timestamp therefore falls into the partial-fee branch, charging only on the newly queued amount, which can be zero. This lets a user repeatedly renew at each window boundary and indefinitely dodge the intended full withdrawal fee on their outstanding balance. Because those fees would otherwise accumulate to the vault, remaining shareholders lose the associated yield, with a concrete example estimating ~$50,000 lost per renewal on a 1% fee and $5M position.