Maia DAO Ecosystem — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Maia DAO Ecosystem, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 74
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 74 closed, publicly disclosed Maia DAO Ecosystem reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Reentrancy, Governance attack, Access control, Front-running / MEV, Integer overflow / underflow, across EVM-Solidity, Move. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Reentrancy findings disclosed against Maia DAO Ecosystem
- Governance attack findings disclosed against Maia DAO Ecosystem
- Access control findings disclosed against Maia DAO Ecosystem
- Front-running / MEV findings disclosed against Maia DAO Ecosystem
- Integer overflow / underflow findings disclosed against Maia DAO Ecosystem
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Maia DAO Ecosystem: `setWeight()` Logic error
A significant logic error in the UlyssesPool.setWeight() function causes corruption of bandwidth accounting whenever pool weights are updated. The vulnerability stems from inverted conditional checks, incorrect scaling math, and flawed tracking of residual bandwidth during rebalancing. This failure leads to persistent misalignment of bandwidth distributions and corrupted balance tracking across destination pools, undermining the protocol's state integrity.
Maia DAO Ecosystem: `VirtualAccount` cannot directly send native tokens
The VirtualAccount contract in the Maia DAO omnichain ecosystem acts as a proxy for users and protocol components to execute target interactions with external dApps and branch routers on hosting chains like Arbitrum. A design limitation in the execution logic prevents native ETH from being passed during external contract calls. As a result, interactions requiring native ETH transfers, such as native asset swaps or bridge actions, consistently revert. This failure impairs the cross-chain interoperability intended for VirtualAccounts.
Maia DAO Ecosystem: Ulysses omnichain - `addbridgeagentfactory` in `rootPort` is not functional
In Maia DAO's Ulysses omnichain architecture, the `addBridgeAgentFactory` function in `RootPort` attempts to register new bridge agent factories by direct index assignment on the `bridgeAgentFactories` dynamic array rather than using `.push()`. This causes transactions to revert with an out-of-bounds access error, completely bricking the function. Additionally, the implementation fails to update the `isBridgeAgentFactory` boolean mapping, preventing added factories from being managed or recognized by protocol access controls. As a result, governance is unable to add new bridge agent factories to the system.
Maia DAO Ecosystem: `ERC4626PartnerManager.sol` mints extra `partnerGovernance` tokens to itself, resulting in over supply of governance token
In Maia DAO's `ERC4626PartnerManager` contract, an accounting flaw in `increaseConversionRate()` causes excessive governance tokens to be minted whenever the conversion rate is updated. When calculating the additional tokens required to back existing user deposits, the contract subtracts its current token balance rather than calculating the delta based on the rate difference (`newRate - bHermesRate`). Because the contract's token balance decreases during normal claims, this logic subtracts an artificially small number and mints significantly more tokens than required. This leads to an oversupply of `partnerGovernance` tokens trapped inside the contract, diluting voting mechanisms and potential reward distributions.
Maia DAO Ecosystem: `BribesFactory::createBribeFlywheel` can be completely blocked from creating any `Flywheel` by a malicious actor
A DoS vulnerability in Maia DAO's BribesFactory allows an attacker to permanently block the creation of bribe flywheels for specific reward tokens. When `createBribeFlywheel` is executed, `FlywheelCore` is instantiated with its reward address temporarily set to `address(0)` before updating it via `setFlywheelRewards`. During this update, `FlywheelCore` queries the token balance of `address(0)` and attempts a `safeTransferFrom` if the balance is non-zero. By sending as little as 1 wei of the reward token to `address(0)`, an attacker causes all subsequent calls to `createBribeFlywheel` for that token to revert due to unapproved transfers from the zero address.
Maia DAO Ecosystem: Unstaking `vMAIA` tokens on the first Tuesday of the month can be offset
In the Maia DAO ecosystem, `vMAIA` governance token withdrawals are meant to be strictly constrained to the first Tuesday of each calendar month. However, the contract's state tracking mechanism for the monthly unstaking window depends on a state update that is only triggered when a user performs a withdrawal during that window. If no user interacts with the contract on the first Tuesday, the withdrawal window state remains un-updated, causing subsequent Tuesday requests later in the month to be treated as valid. This allows users to bypass the intended monthly lockup schedule whenever there is no activity on the designated first Tuesday.
All reports in this group
- Maia DAO Ecosystem: A lack of slippage protection can lead to a significant loss of user fundsFront-running / MEV$0
- Maia DAO Ecosystem: `vMaia` Lacks of override in `forfeitBoost`Integer overflow/underflow$0
- Maia DAO Ecosystem: Branch Strategies lose yield due to wrong implementation of time limit in `BranchPort.sol`Oracle manipulation$0
- Maia DAO Ecosystem: `ERC4626PartnerManager.checkTransfer` does not check `amount` correctly, as it applies `bHermesRate` to `balanceOf[from]`, but not `amount`.Governance attack$0
- Maia DAO Ecosystem: Removing a `UniswapV3Gauge` via `UniswapV3GaugeFactory` does not actually remove it from the `UniswapV3Staker`. The gauge still gains rewards and can be staked too (even though deprecated). Plus old stakers can game the rewards of new stake…Governance attack$0
- Maia DAO Ecosystem: Claiming outstanding utility tokens from `vMaia` vault DoS on `pbHermes<>bHermes` conversion rate `>` 1Governance attack$0
- Maia DAO Ecosystem: Some functions in the Talos contracts do not allow user to supply `slippage` and `deadline`, which may cause swap revertFront-running / MEV$0
- Maia DAO Ecosystem: Maia Governance token balance dilution in `vMaia` vault is breaking the conversion rate mechanismInteger overflow/underflow$0
- Maia DAO Ecosystem: Wrong consideration of `blockformation` period causes incorrect `votingPeriod` and `votingDelay` calculationsGovernance attack$0
- Maia DAO Ecosystem: Incorrect accounting logic for `fallback` gas will lead to insolvencyBridge exploit$0
- Maia DAO Ecosystem: A user can call `callOutSigned` without paying for gas by reentering `anyExecute` with Virtual AccountReentrancy$0
- Maia DAO Ecosystem: `BoostAggregator` owner can set fees to 100% and steal all of the user's rewardsAccess control$0
- Maia DAO Ecosystem: `_decrementWeightUntilFree()` has a possible infinite loopReentrancy$0
- Maia DAO Ecosystem: When the `anyExecute` call is made to `RootBridgeAgent` with a `depositNonce` that has been recorded in `executionHistory`, `initialGas` and `userFeeInfo` will not be updated, which would affect the next caller of `retrySettlement`.Bridge exploit$0
- Maia DAO Ecosystem: `migratePartnerVault()` in the first vault does not work properlyAccess control$0
- Maia DAO Ecosystem: Depositing gas through `depositGasAnycallConfig` should not withdraw the `nativeToken`Bridge exploit$0
- Maia DAO Ecosystem: Although `ERC20Boost.decrementGaugesBoostIndexed` function would require the user to remove all of their boosts from a deprecated gauge at once, such a user can instead call `ERC20Boost.decrementGaugeBoost` function multiple times to utiliz…Governance attack$0
- Maia DAO Ecosystem: The user is enforced to overpay for the `fallback` gas when calling `retryDeposit`Bridge exploit$0
- Maia DAO Ecosystem: Many `create` methods are suspicious of the reorg attackGovernance attack$0
- Maia DAO Ecosystem: Deploy flow of `Talos` is brokenGovernance attack$0
- Maia DAO Ecosystem: Removing more gauge weight than it should be while transferring `ERC20Gauges` tokenReentrancy$0
- Maia DAO Ecosystem: `updatePeriod()` has less minting of `HERMES`Governance attack$0
- Maia DAO Ecosystem: Replenishing gas is missing in `_payFallbackGas` of `RootBridgeAgent`Bridge exploit$0
- Maia DAO Ecosystem: Slippage controls for calling `bHermes` contract's `ERC4626DepositOnly.deposit` and `ERC4626DepositOnly.mint` functions are missingInteger overflow/underflow$0
- Maia DAO Ecosystem: `RootBridgeAgent.redeemSettlement` can be front-run using `RootBridgeAgent.retrySettlement`, causing redeem to DoSAccess control$0
- Maia DAO Ecosystem: `BaseV2Minter` DAO reward shares are calculated wrongGovernance attack$0
- Maia DAO Ecosystem: Incorrectly reading the offset from the received data parameter to get the `depositNonce` in the `BranchBridgeAgent::anyFallback()` functionBridge exploit$0
- Maia DAO Ecosystem: Cross-chain messaging via `Anycall` will failBridge exploit$0
- Maia DAO Ecosystem: Incorrect flow of adding liquidity in `UlyssesRouter.sol`Reentrancy$0
- Maia DAO Ecosystem: On Ulysses omnichain - `RetrieveDeposit` might never be able to trigger the `Fallback` functionBridge exploit$0
- Maia DAO Ecosystem: `Rerange`/`rebalance` should not use `protocolFee` as an asset for adding liquidityReentrancy$0
- Maia DAO Ecosystem: A malicious user can front-run Gauges's call `addBribeFlywheel` to steal bribe rewardsFlash loan attack$0
- Maia DAO Ecosystem: Removing a `BribeFlywheel` from a Gauge does not remove the reward asset from the rewards depo, making it impossible to add a new Flywheel with the same reward tokenAccess control$0
- Maia DAO Ecosystem: Accessing the incorrect offset to get the nonce when a flag is 0x06 in `RootBridgeAgent::anyExecute()` will lead to marked as executed incorrect nonces and could potentially cause a DoSBridge exploit$0
- Maia DAO Ecosystem: `UlyssesToken` asset ID accounting errorInteger overflow/underflow$0
- Maia DAO Ecosystem: A malicious user can set any contract as a local `hToken` for an underlying token since there is no access control for `_addLocalToken`Reentrancy$0
- Maia DAO Ecosystem: Lack of a return value handing in `ArbitrumBranchBridgeAgent._performCall()` could cause users' deposit to be locked in contractBridge exploit$0
- Maia DAO Ecosystem: An attacker can redeposit gas after `forceRevert()` to freeze all deposited gas budget of `Root Bridge Agent`Reentrancy$0
- Maia DAO Ecosystem: Missing the unwrapping of native token in `RootBridgeAgent.sweep()` causes fees to be stuckBridge exploit$0
- Maia DAO Ecosystem: Multiple issues with `retrySettlement()` and `retrieveDeposit()` will cause loss of users' bridging depositsBridge exploit$0
- Maia DAO Ecosystem: A user can bypass bandwidth limit by repeatedly "balancing" the poolGovernance attack$0
- Maia DAO Ecosystem: Overpaying remaining gas to the user for failing `anyExecute` call due to an incorrect gas unit calculation in `BranchBridgeAgent`Access control$0
- Maia DAO Ecosystem: An attacker can exploit the "deposit" to drain the `Ulysess Liquidity Pool`Integer overflow/underflow$0
- Maia DAO Ecosystem: Second per liquidity inside could overflow `uint256` causing the LP position to be locked in `UniswapV3Staker`Integer overflow/underflow$0
- Maia DAO Ecosystem: Reentrancy attack possible on `RootBridgeAgent.retrySettlement()` with missing access control for `RootBridgeAgentFactory.createBridgeAgent()`Reentrancy$0
- Maia DAO Ecosystem: The difference between `gasLeft` and `gasAfterTransfer` is greater than `TRANSFER_OVERHEAD`, causing `anyExecute` to always failAccess control$0
- Maia DAO Ecosystem: An attacker can mint an arbitrary amount of `hToken` on `RootChain`Access control$0
- Maia DAO Ecosystem: Re-adding a deprecated gauge in a new epoch before calling `updatePeriod()`/`queueRewardsForCycle()` will leave some gauges without rewardsGovernance attack$0
- Maia DAO Ecosystem: User may underpay for the remote call `ExecutionGas` on the root chainBridge exploit$0
- Maia DAO Ecosystem: `redeem()` in `beforeRedeem` is using the wrong owner parameterReentrancy$0
- Maia DAO Ecosystem: `RootBridgeAgent->CheckParamsLib#checkParams` does not check that `_dParams.token` is underlying of `_dParams.hToken`Bridge exploit$0
- Maia DAO Ecosystem: `BranchBridgeAgent._normalizeDecimalsMultiple` will always revert because of the lack of allocating memoryBridge exploit$0
- Maia DAO Ecosystem: In `ERC20Boost.sol`, a user can be `attached` to a gauge and have no boost balance.Governance attack$0
- Maia DAO Ecosystem: An attacker can steal Accumulated Awards from `RootBridgeAgent` by abusing `retrySettlement()`Bridge exploit$0
- Maia DAO Ecosystem: Multiple issues with decimal scaling will cause incorrect accounting of hTokens and underlying tokensBridge exploit$0
- Maia DAO Ecosystem: `withdrawProtocolFees()` Possible malicious or accidental withdrawal of all rewardsAccess control$0
- Maia DAO Ecosystem: `TalosBaseStrategy#init()` lacks slippage protectionReentrancy$0
- Maia DAO Ecosystem: Due to inadequate checks, an adversary can call `BranchBridgeAgent#retrieveDeposit` with an invalid `_depositNonce`, which would lead to a loss of other users' deposits.Bridge exploit$0
- Maia DAO Ecosystem: If a STRATEGY TOKEN is "Toggled off" STRATEGIES will still be able to withdraw, but returning of tokens with `replenishReserves` will be disabled.Access control$0
- Maia DAO Ecosystem: `vMaia` is ERC-4626 compliant, but the `maxWithdraw` & `maxRedeem` functions are not fully up to EIP-4626's specificationGovernance attack$0
- Maia DAO Ecosystem: `MIN_FALLBACK_RESERVE` (in `BranchBridgeAgent`) doesn't consider the actual gas consumption in ``AnyCall`` contracts, which lets the user underpay the actual cost when replenishing the execution budgetAccess control$0
- Maia DAO Ecosystem: Use of `slot0` to get `sqrtPriceLimitX96` can lead to price manipulation.Oracle manipulation$0
- Maia DAO Ecosystem: `UlyssesToken.setWeights(...)` can cause user loss of assets on vault deposits/withdrawalsGovernance attack$0
- Maia DAO Ecosystem: DoS of `RootBridgeAgent` due to missing negation of return values for `UniswapV3Pool.swap()`Integer overflow/underflow$0
- Maia DAO Ecosystem: `UlyssesPool.sol` does not match `EIP4626` because of the preview functionsGovernance attack$0
- Maia DAO Ecosystem: Governance relies on the current `totalSupply` of `bHermes` when calculating `proposalThresholdAmount` and `quorumVotesAmount`Governance attack$0
- Maia DAO Ecosystem: Inconsistencies in reading the encoded parameters received in the `_sParams` argument in `BranchBridgeAgent::clearTokens()`Bridge exploit$0
- Maia DAO Ecosystem: The `RestakeToken` function is not permissionlessAccess control$0