Lavarage — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Lavarage, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 3
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 3 closed, publicly disclosed Lavarage reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Front-running / MEV, Oracle manipulation, across EVM-Solidity, Solana-Rust. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Lavarage
- Front-running / MEV findings disclosed against Lavarage
- Oracle manipulation findings disclosed against Lavarage
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Lavarage: Collateral can be claimed back without repaying its corresponding loan due to insufficient instruction validation
The Lavarage protocol is susceptible to a collateral withdrawal bypass vulnerability due to insufficient validation of account contexts in its loan repayment logic. An attacker can construct a malicious transaction that links the withdrawal of collateral from one borrow position to the repayment of a different, dust-sized position. This allows users to claim collateral without fulfilling the original loan obligations, enabling the drainage of trading pools.
Lavarage: Innocent borrower could incur losses caused by a malicious lender
The Lavarage protocol is vulnerable to a front-running attack where lenders can maliciously increase interest rates to harm borrowers. Because interest rates are managed at the global trading pool level and the protocol mandates a minimum of one day's interest, a lender can front-run a borrowing transaction to spike the rate. This forces the borrower to pay the higher, inflated interest rate for at least one full day, even if the position is repaid immediately. This flaw essentially allows lenders to extract value from borrowers through unfavorable, last-minute parameter adjustments.
Lavarage: A borrower can borrow SOL without backing it by a collateral
Lavarage, a Solana lending program, fails to validate that collateral deposits are tied to the specific borrowing position they fund. Because the borrow instruction only checks that an addCollateral instruction exists in the same transaction without verifying the two reference the same position account, a borrower can open two positions but route both collateral transfers to the first position. Repaying the first position then permits withdrawing both collaterals, leaving the second position's loan fully unbacked — a direct theft of lender SOL. The report includes a passing Anchor test proving the extraction.