Maia DAO — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Maia DAO, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 14
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 14 closed, publicly disclosed Maia DAO reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Access control, Bridge exploit, Governance attack, Reentrancy, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Access control findings disclosed against Maia DAO
- Bridge exploit findings disclosed against Maia DAO
- Governance attack findings disclosed against Maia DAO
- Reentrancy findings disclosed against Maia DAO
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Maia DAO: if the Virtual Account's owner is a Contract Account (multisig wallet), attackers can gain control of the Virtual Accounts by gaining control of the same owner's address in a different chain
Maia DAO's RootPort maps Virtual Accounts in the root environment solely based on the initiator's address without binding it to the source chain ID. If a user interacts with the protocol via a contract account (such as a multisig wallet) on one chain, an attacker who deploys or takes control of a contract at the exact same address on a different chain can trigger cross-chain actions using that same Virtual Account. This allows the attacker to hijack the victim's Virtual Account and drain all assets stored within it in the root environment.
Maia DAO: Redeeming a Settlement won't work for unsigned messages when the communicating dApps have different addresses on the different chains
In Maia DAO's cross-chain messaging setup, executing settlements through the MulticallRootRouter automatically sets the settlement refundee address to match the destination chain recipient address. When a cross-chain settlement fails on execution, the protocol requires the settlement owner (the refundee) to initiate the refund on the root chain. However, because dApp contract deployments frequently reside at different contract addresses across different blockchains—or may not exist on the root chain at all—the designated refundee address on the root chain cannot call the recovery function. As a consequence, assets locked in failed cross-chain settlements become permanently stuck without any mechanism for retrieval.
Maia DAO: All tokens can be stolen from `VirtualAccount` due to missing access modifier
A missing authorization modifier in Maia DAO's `VirtualAccount` contract allowed any arbitrary external caller to execute unauthorized functions. While `call()` correctly enforced `requiresApprovedCaller`, the adjacent `payableCall()` function omitted this check. Consequently, unprivileged attackers could route arbitrary calls through `payableCall()` to execute token transfers or contract calls, completely draining non-native tokens and assets stored in any target `VirtualAccount`.
Maia DAO: If `RootBridgeAgent.lzReceiveNonBlocking` reverts internally, the native token sent by relayer to RootBridgeAgent is left in RootBridgeAgent
When receiving LayerZero cross-chain messages configured with adapterParams V2 (airdrop), LayerZero relayers send native gas tokens to the RootBridgeAgent contract prior to invoking `lzReceive`. However, `RootBridgeAgent.lzReceive` uses `excessivelySafeCall` to execute internal logic in `lzReceiveNonBlocking` without reverting on inner failure (except for the Arbitrum branch). If internal execution reverts, the top-level transaction succeeds while trapping the incoming native gas tokens inside the contract, allowing opportunistic attackers to siphon the stranded funds via subsequent calls.
Maia DAO: The governance will fail to add an ecosystem token if someone creates a hToken that uses that ecosystem token
In Maia DAO's omni-chain system, permissionless invocation of token registration allows an attacker to create a local wrapper token whose underlying address matches an uninitialized ecosystem token address. This updates the `getLocalTokenFromUnderlying` mapping in `RootPort`. Consequently, when governance attempts to execute `addEcosystemToken()`, an invalid state check causes the transaction to revert, permanently blocking governance from initializing ecosystem tokens.
Maia DAO: `ArbitrumBranchBridgeAgent::_performFallbackCall` function does not refund users their excess native gas deposit
In Maia DAO's cross-chain bridging architecture, retrying settlement calls sends native ETH gas tokens to the local branch bridge agent. On Arbitrum, if execution fails in `ArbitrumBranchBridgeAgent` after enabling fallback handling, `_performFallbackCall` is invoked. However, unlike other branch bridge agents in the system, `ArbitrumBranchBridgeAgent::_performFallbackCall` fails to transfer the unspent native ETH gas balance back to the user or refundee, leading to locked funds in the contract.
All reports in this group
- Maia DAO: When using BaseBranchRouter as a router on the 'Arbitrum' branch, we are unable to invoke the 'callOutAndBridge' function.Bridge exploit$0
- Maia DAO: No deposit cross-chain calls/communication can still originate from a removed branch bridge agentBridge exploit$0
- Maia DAO: `addGlobalToken()` `localAdress` could be overwrittenBridge exploit$0
- Maia DAO: Incorrect flag results to `_hasFallbackToggled` always set to false on `createMultipleSettlement`.Bridge exploit$0
- Maia DAO: Message channels can be blocked resulting in DoSBridge exploit$0
- Maia DAO: `BaseBranchRouter._transferAndApproveToken` may revert in some casesBridge exploit$0
- Maia DAO: Depositors could lose all their deposited tokens (including the hTokens) if their address is blacklisted in one of all the deposited underlyingTokensBridge exploit$0
- Maia DAO: Incorrect source address decoding in RootBridgeAgent and BranchBridgeAgent's `_requiresEndpoint` breaks LayerZero communicationReentrancy$0