Lybra Finance — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Lybra Finance, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 21
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 21 closed, publicly disclosed Lybra Finance reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Oracle manipulation, Access control, Integer overflow / underflow, Governance attack, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Lybra Finance
- Oracle manipulation findings disclosed against Lybra Finance
- Access control findings disclosed against Lybra Finance
- Integer overflow / underflow findings disclosed against Lybra Finance
- Governance attack findings disclosed against Lybra Finance
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Lybra Finance: Incorrect function call in `LybraRETHVault`'s `getAssetPrice`
The Lybra Finance protocol contained a critical integration error within the `LybraRETHVault` contract, specifically regarding how it fetched the price for rETH collateral. The contract attempted to call a function named `getExchangeRatio()` on the rETH token contract, which does not exist. This discrepancy caused the `getAssetPrice()` function to fail consistently, effectively bricking the vault and preventing any operations that relied on collateral pricing.
Lybra Finance: If `ProtocolRewardsPool` is insufficient in EUSD, users will not be able to claim any rewards
The ProtocolRewardsPool contract in Lybra Finance contains a flawed reward withdrawal logic that prevents users from claiming their earnings when the pool's EUSD balance is insufficient. Due to an incorrect mathematical expression used to handle cases where available rewards exceed current contract balances, the contract attempts to initiate transfers that exceed its actual holdings, causing transactions to revert. This results in a denial-of-service for reward claims, effectively locking user rewards and preventing the proper distribution of other assets like PeUSD.
Lybra Finance: Lack of timelock on `rigidRedemption`, enables to steal yield from other users
The Lybra Finance protocol utilizes a timelock and exit fee mechanism on its primary `withdraw` function to discourage short-term liquidity providers from extracting yield generated by other users. However, the `rigidRedemption` function lacks these equivalent safeguards. This inconsistency permits a malicious user to deposit assets immediately before a rebasing event, capture the resulting yield, and exit instantly via `rigidRedemption` without penalty. This flaw allows for the theft of yield from long-term participants, creating an unfair incentive structure that undermines the protocol's intended reward distribution.
Lybra Finance: There is no mechanism that prevents from minting less than `esLBR` maximum supply in `StakingRewardsV2`
The Lybra Finance protocol contains a logical flaw where the hard-coded maximum supply of the esLBR token can be reached, leading to a permanent denial-of-service on reward distribution. The minting function in the esLBR contract prevents any further minting once the 100,000,000 supply cap is met, but the StakingRewardsV2 contract does not restrict reward emissions to stay within this limit. Consequently, if the total supply is reached, users become unable to claim their earned rewards or stake tokens, as the contract's minting calls will consistently revert.
Lybra Finance: Fixed reward percentage for liquidators in the eUSD vault may cause a liquidation crisis
Lybra Finance's liquidation mechanism for eUSD and peUSD vaults suffers from a logic error due to a fixed 10% reward for liquidators. When a user's collateral ratio drops below 110%, this fixed reward is too aggressive, causing the position's collateral ratio to decrease further rather than recover following a liquidation. This failure to improve position health creates an incentive for repeated liquidations that drain collateral and lead to the accumulation of bad debt, threatening the protocol's overall solvency.
Lybra Finance: `LybraPeUSDVaultBase.rigidRedemption` should use `getBorrowedOf` instead of `borrowed`
The LybraPeUSDVaultBase contract incorrectly calculates redemption eligibility by using an incomplete debt accounting variable. Specifically, the rigidRedemption function uses the borrowed mapping—which excludes accrued fees—instead of the comprehensive getBorrowedOf function. This flaw allows redemptions to proceed against providers whose actual collateralization ratio falls below the required 100% threshold, potentially impacting the protocol's solvency and debt management stability.
All reports in this group
- Lybra Finance: Incorrectly implemented modifiers in `LybraConfigurator.sol` allow any address to call functions that are supposed to be restrictedAccess control$0
- Lybra Finance: Rewards for initial period can be lost in all of the synthetix derivative contractsAccess control$0
- Lybra Finance: Incorrect Reward Distribution Calculation in `ProtocolRewardsPool`Logic error$0
- Lybra Finance: The `EUSDMiningIncentives` contract is incorrectly implemented and can allow for more than the intended amount of rewards to be mintedLogic error$0
- Lybra Finance: Liquidation won't work when bad and safe collateral ratio are set to default valuesInteger overflow/underflow$0
- Lybra Finance: No check for Individual mint amount surpassing 10% when the circulation reaches 10\_000\_000 in `mint()` of `LybraEUSDVaultBase` contractLogic error$0
- Lybra Finance: Making `_totalSupply` and `_totalShares` imbalance significantly by providing fake income leads to stealing fundLogic error$0
- Lybra Finance: Understatement of `poolTotalPeUSDCirculation` amounts due to incorrect accounting after function `_repay` is calledLogic error$0
- Lybra Finance: Governance wrongly calculates `_quorumReached()`Governance attack$0
- Lybra Finance: There is a vulnerability in the `executeFlashloan` function of the `PeUSDMainnet` contract. Hackers can use this vulnerability to burn other people's eUSD token balance without permissionFlash loan attack$0
- Lybra Finance: `EUSD.mint` function wrong assumption of cases when calculated sharesAmount = 0Governance attack$0
- Lybra Finance: Wrong `proposalThreshold` amount in `LybraGovernance.sol`Governance attack$0
- Lybra Finance: Allowing `refreshReward()` to fail during minting or buring esLBR could result in gain or loss previously earned rewardGovernance attack$0
- Lybra Finance: `stakerewardV2pool.withdraw()` should check the user's boost lock status.Logic error$0
- Lybra Finance: Volatile prices and lack of checks on `rigidRedemption()` can cause users to purchase stETH at unwanted pricesFront-running / MEV$0