Kelp DAO — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Kelp DAO, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 3
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 3 closed, publicly disclosed Kelp DAO reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Reentrancy, Oracle manipulation, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Reentrancy findings disclosed against Kelp DAO
- Oracle manipulation findings disclosed against Kelp DAO
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Kelp DAO: Protocol mints less rsETH on deposit than intended
In Kelp DAO's `LRTDepositPool`, user asset deposits result in minting less `rsETH` than intended due to an incorrect execution order. When `depositAsset` is called, the protocol transfers the asset tokens to the pool contract before calculating `rsEthPrice`. Because `rsEthPrice` relies on the pool's asset balance (`balanceOf(address(this))`), the pending deposit inflates the calculated total locked ETH and yields an artificially high `rsETH` price, causing depositors to receive significantly discounted `rsETH` mint amounts.
Kelp DAO: Update in strategy will cause wrong issuance of shares
A logic error in Kelp DAO's strategy update mechanism causes asset balances stored in legacy strategies to be ignored during total deposit calculations. When `NodeDelegator.getAssetBalance()` is called after a strategy reference update, it queries only the active strategy, excluding assets remaining in prior strategy contracts from `getTotalAssetDeposits`. This artificial reduction in tracked asset deposits depresses the rsETH share price calculated by `LRTOracle`. Consequently, new depositors can deposit assets and mint rsETH at an undervalued exchange rate, acquiring more share value than their deposited principal warrants.
Kelp DAO: The price of rsETH could be manipulated by the first staker
A first-depositor vulnerability in Kelp DAO's LRT system allows an attacker to manipulate the share price of rsETH. When the protocol's total supply of rsETH is minimal, an attacker can mint a tiny amount of rsETH and directly donate underlying assets to the deposit pool or node delegators. This direct donation inflates the calculated price returned by `LRTOracle.getRSETHPrice()`. Consequently, subsequent deposits by victims calculate zero rsETH shares to mint due to integer division truncation, allowing the attacker to steal the deposited funds upon redemption.