Lybra Finance — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Lybra Finance, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 21
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 21 closed, publicly disclosed Lybra Finance reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Access control, Logic error, Governance attack, Oracle manipulation, Integer overflow / underflow, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Access control findings disclosed against Lybra Finance
- Logic error findings disclosed against Lybra Finance
- Governance attack findings disclosed against Lybra Finance
- Oracle manipulation findings disclosed against Lybra Finance
- Integer overflow / underflow findings disclosed against Lybra Finance
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Lybra Finance: Rewards for initial period can be lost in all of the synthetix derivative contracts
Lybra Finance's staking reward contracts suffer from an incentive distribution flaw where rewards are initialized upon an administrative function call rather than upon the first participant's entry. This architectural choice forces the reward timer to start immediately, meaning any time elapsed between the reward notification and the first user deposit results in permanently locked, unclaimed tokens. This issue affects multiple mining and reward pools across the protocol, leading to an inefficient distribution and partial loss of intended staking incentives.
Lybra Finance: Understatement of `poolTotalPeUSDCirculation` amounts due to incorrect accounting after function `_repay` is called
Lybra Finance's repayment mechanism contains an accounting error where the `poolTotalPeUSDCirculation` variable is incorrectly decremented. When a user repays their debt, the repayment includes both fees and principal; only the principal portion is burned. Because the code reduces the total circulation count by the entire repayment amount rather than just the burned principal, the protocol's tracking of circulating tokens becomes inaccurate, leading to an understated supply.
Lybra Finance: Governance wrongly calculates `_quorumReached()`
Lybra Finance's governance contract contains a logic flaw that causes all proposals to fail to meet their required quorum. The _quorumReached internal function incorrectly sums 'against' and 'abstain' votes instead of the total number of votes cast. This creates a functional denial-of-service for the governance process, as legitimate proposals cannot reach the threshold required for enactment.
Lybra Finance: Lack of timelock on `rigidRedemption`, enables to steal yield from other users
The Lybra Finance protocol utilizes a timelock and exit fee mechanism on its primary `withdraw` function to discourage short-term liquidity providers from extracting yield generated by other users. However, the `rigidRedemption` function lacks these equivalent safeguards. This inconsistency permits a malicious user to deposit assets immediately before a rebasing event, capture the resulting yield, and exit instantly via `rigidRedemption` without penalty. This flaw allows for the theft of yield from long-term participants, creating an unfair incentive structure that undermines the protocol's intended reward distribution.
Lybra Finance: Liquidation won't work when bad and safe collateral ratio are set to default values
The Lybra Finance protocol contains a critical logic error in how it handles default collateral ratio configurations, which leads to a denial of service for the liquidation flow. Specifically, the system performs arithmetic operations on raw state variables rather than using established getter functions that account for default values. This causes an underflow revert whenever the protocol attempts to determine liquidation thresholds while the ratios remain at their default values. Consequently, liquidations are blocked, and administrative functions to update these ratios are rendered unusable due to the inconsistent state validation.
Lybra Finance: The `EUSDMiningIncentives` contract is incorrectly implemented and can allow for more than the intended amount of rewards to be minted
The Lybra Finance `EUSDMiningIncentives` contract contains a critical accounting flaw in its reward distribution logic. The protocol calculates individual user stakes by aggregating borrowed amounts across both EUSD and PeUSD vaults, but calculates the protocol-wide total stake by only considering the supply of EUSD tokens. This inconsistency causes the `totalStaked` denominator to be smaller than it should be, resulting in an inflated reward-per-token ratio. Consequently, users are minted significantly more esLBR rewards than intended, leading to unexpected inflation of the reward supply.
All reports in this group
- Lybra Finance: There is no mechanism that prevents from minting less than `esLBR` maximum supply in `StakingRewardsV2`Logic error$0
- Lybra Finance: Incorrect function call in `LybraRETHVault`'s `getAssetPrice`Logic error$0
- Lybra Finance: Making `_totalSupply` and `_totalShares` imbalance significantly by providing fake income leads to stealing fundLogic error$0
- Lybra Finance: Allowing `refreshReward()` to fail during minting or buring esLBR could result in gain or loss previously earned rewardGovernance attack$0
- Lybra Finance: Incorrectly implemented modifiers in `LybraConfigurator.sol` allow any address to call functions that are supposed to be restrictedAccess control$0
- Lybra Finance: `EUSD.mint` function wrong assumption of cases when calculated sharesAmount = 0Governance attack$0
- Lybra Finance: Wrong `proposalThreshold` amount in `LybraGovernance.sol`Governance attack$0
- Lybra Finance: `LybraPeUSDVaultBase.rigidRedemption` should use `getBorrowedOf` instead of `borrowed`Logic error$0
- Lybra Finance: There is a vulnerability in the `executeFlashloan` function of the `PeUSDMainnet` contract. Hackers can use this vulnerability to burn other people's eUSD token balance without permissionFlash loan attack$0
- Lybra Finance: Volatile prices and lack of checks on `rigidRedemption()` can cause users to purchase stETH at unwanted pricesFront-running / MEV$0
- Lybra Finance: `stakerewardV2pool.withdraw()` should check the user's boost lock status.Logic error$0
- Lybra Finance: Incorrect Reward Distribution Calculation in `ProtocolRewardsPool`Logic error$0
- Lybra Finance: Fixed reward percentage for liquidators in the eUSD vault may cause a liquidation crisisLogic error$0
- Lybra Finance: No check for Individual mint amount surpassing 10% when the circulation reaches 10\_000\_000 in `mint()` of `LybraEUSDVaultBase` contractLogic error$0
- Lybra Finance: If `ProtocolRewardsPool` is insufficient in EUSD, users will not be able to claim any rewardsLogic error$0