Maia DAO Ecosystem — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Maia DAO Ecosystem, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 74
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 74 closed, publicly disclosed Maia DAO Ecosystem reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Front-running / MEV, Bridge exploit, Access control, Integer overflow / underflow, Governance attack, across EVM-Solidity, Move. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Front-running / MEV findings disclosed against Maia DAO Ecosystem
- Bridge exploit findings disclosed against Maia DAO Ecosystem
- Access control findings disclosed against Maia DAO Ecosystem
- Integer overflow / underflow findings disclosed against Maia DAO Ecosystem
- Governance attack findings disclosed against Maia DAO Ecosystem
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Maia DAO Ecosystem: Some functions in the Talos contracts do not allow user to supply `slippage` and `deadline`, which may cause swap revert
Multiple core functions in Maia DAO's Talos strategy contracts, including deposit, init, withdrawAll, and compoundFees, hardcode minimum slippage output parameters to zero and pass block.timestamp as the deadline. Because transactions retain block.timestamp as their deadline, they never expire while waiting in the mempool. Combined with zero slippage protection, pending transactions can be front-run and sandwiched by MEV bots or malicious actors, causing users to execute swaps at maximally adverse prices and sustain financial losses.
Maia DAO Ecosystem: Inconsistencies in reading the encoded parameters received in the `_sParams` argument in `BranchBridgeAgent::clearTokens()`
A data parsing mismatch in Maia DAO's `BranchBridgeAgent::clearTokens()` function caused token addresses to be computed incorrectly during multi-settlement cross-chain transfers. While the messaging layer spec encodes `hTokens`, `tokens`, `amounts`, and `deposits` into 32-byte fields within `_sParams`, `clearTokens()` parsed `tokens` by slicing only 20 bytes instead of reading the full 32-byte slot. This byte offset misalignment results in malformed token address computations, preventing correct token clearing and causing bridge assets to become stuck on the root chain.
Maia DAO Ecosystem: Ulysses omnichain - `addbridgeagentfactory` in `rootPort` is not functional
In Maia DAO's Ulysses omnichain architecture, the `addBridgeAgentFactory` function in `RootPort` attempts to register new bridge agent factories by direct index assignment on the `bridgeAgentFactories` dynamic array rather than using `.push()`. This causes transactions to revert with an out-of-bounds access error, completely bricking the function. Additionally, the implementation fails to update the `isBridgeAgentFactory` boolean mapping, preventing added factories from being managed or recognized by protocol access controls. As a result, governance is unable to add new bridge agent factories to the system.
Maia DAO Ecosystem: Maia Governance token balance dilution in `vMaia` vault is breaking the conversion rate mechanism
A flaw in Maia DAO's `vMaia` vault (`ERC4626PartnerManager`) causes governance token balance inflation due to missing burn logic during withdrawals. When users deposit underlying Maia tokens into the vault, partner governance tokens (`pbHermes`) are minted to the contract, but withdrawing users do not trigger a corresponding burn of `pbHermes`. An attacker can repeatedly deposit and withdraw tokens to artificially dilute and expand the vault's `pbHermes` balance. Because rate updates via `increaseConversionRate()` enforce upper and lower bounds derived from token balance ratios, this dilution forces the calculated minimum conversion rate to surpass the allowed maximum rate, permanently breaking administrative conversion rate adjustments.
Maia DAO Ecosystem: `updatePeriod()` has less minting of `HERMES`
When updating weekly reward periods, the HERMES token minter contract calculates required mint amounts by checking its raw token balance against required distributions. If rewards from prior cycles remain uncollected (for instance when reward queuing fails or is delayed), the contract misinterprets those reserved funds as available liquidity for the new week. As a result, fewer HERMES tokens are minted than required, leading to liquidity shortfalls and transaction reverts when gauge rewards are subsequently claimed.
Maia DAO Ecosystem: Removing more gauge weight than it should be while transferring `ERC20Gauges` token
Maia DAO's ERC20Gauges contract suffers from a logic flaw where token transfers cause excessive unallocation of user voting weight. When a user transfers tokens, the contract automatically attempts to free up enough gauge weight, but it improperly uses a global accounting variable (totalFreed) in its loop termination logic instead of a user-specific one (userFreed). As a result, the contract ignores weight already freed from deprecated gauges, causing it to unnecessarily strip additional voting weight from the user's active gauges.
All reports in this group
- Maia DAO Ecosystem: `ERC4626PartnerManager.checkTransfer` does not check `amount` correctly, as it applies `bHermesRate` to `balanceOf[from]`, but not `amount`.Governance attack$0
- Maia DAO Ecosystem: Although `ERC20Boost.decrementGaugesBoostIndexed` function would require the user to remove all of their boosts from a deprecated gauge at once, such a user can instead call `ERC20Boost.decrementGaugeBoost` function multiple times to utiliz…Governance attack$0
- Maia DAO Ecosystem: `migratePartnerVault()` in the first vault does not work properlyAccess control$0
- Maia DAO Ecosystem: `Rerange`/`rebalance` should not use `protocolFee` as an asset for adding liquidityReentrancy$0
- Maia DAO Ecosystem: `BranchBridgeAgent._normalizeDecimalsMultiple` will always revert because of the lack of allocating memoryBridge exploit$0
- Maia DAO Ecosystem: `vMaia` is ERC-4626 compliant, but the `maxWithdraw` & `maxRedeem` functions are not fully up to EIP-4626's specificationGovernance attack$0
- Maia DAO Ecosystem: An attacker can mint an arbitrary amount of `hToken` on `RootChain`Access control$0
- Maia DAO Ecosystem: Incorrect flow of adding liquidity in `UlyssesRouter.sol`Reentrancy$0
- Maia DAO Ecosystem: Incorrect accounting logic for `fallback` gas will lead to insolvencyBridge exploit$0
- Maia DAO Ecosystem: Slippage controls for calling `bHermes` contract's `ERC4626DepositOnly.deposit` and `ERC4626DepositOnly.mint` functions are missingInteger overflow/underflow$0
- Maia DAO Ecosystem: Overpaying remaining gas to the user for failing `anyExecute` call due to an incorrect gas unit calculation in `BranchBridgeAgent`Access control$0
- Maia DAO Ecosystem: Use of `slot0` to get `sqrtPriceLimitX96` can lead to price manipulation.Oracle manipulation$0
- Maia DAO Ecosystem: Replenishing gas is missing in `_payFallbackGas` of `RootBridgeAgent`Bridge exploit$0
- Maia DAO Ecosystem: `setWeight()` Logic errorReentrancy$0
- Maia DAO Ecosystem: An attacker can steal Accumulated Awards from `RootBridgeAgent` by abusing `retrySettlement()`Bridge exploit$0
- Maia DAO Ecosystem: Unstaking `vMAIA` tokens on the first Tuesday of the month can be offsetGovernance attack$0
- Maia DAO Ecosystem: Accessing the incorrect offset to get the nonce when a flag is 0x06 in `RootBridgeAgent::anyExecute()` will lead to marked as executed incorrect nonces and could potentially cause a DoSBridge exploit$0
- Maia DAO Ecosystem: The `RestakeToken` function is not permissionlessAccess control$0
- Maia DAO Ecosystem: Lack of a return value handing in `ArbitrumBranchBridgeAgent._performCall()` could cause users' deposit to be locked in contractBridge exploit$0
- Maia DAO Ecosystem: `UlyssesToken` asset ID accounting errorInteger overflow/underflow$0
- Maia DAO Ecosystem: `UlyssesToken.setWeights(...)` can cause user loss of assets on vault deposits/withdrawalsGovernance attack$0
- Maia DAO Ecosystem: `BribesFactory::createBribeFlywheel` can be completely blocked from creating any `Flywheel` by a malicious actorAccess control$0
- Maia DAO Ecosystem: `_decrementWeightUntilFree()` has a possible infinite loopReentrancy$0
- Maia DAO Ecosystem: `ERC4626PartnerManager.sol` mints extra `partnerGovernance` tokens to itself, resulting in over supply of governance tokenAccess control$0
- Maia DAO Ecosystem: Re-adding a deprecated gauge in a new epoch before calling `updatePeriod()`/`queueRewardsForCycle()` will leave some gauges without rewardsGovernance attack$0
- Maia DAO Ecosystem: Many `create` methods are suspicious of the reorg attackGovernance attack$0
- Maia DAO Ecosystem: A user can bypass bandwidth limit by repeatedly "balancing" the poolGovernance attack$0
- Maia DAO Ecosystem: An attacker can redeposit gas after `forceRevert()` to freeze all deposited gas budget of `Root Bridge Agent`Reentrancy$0
- Maia DAO Ecosystem: Deploy flow of `Talos` is brokenGovernance attack$0
- Maia DAO Ecosystem: Second per liquidity inside could overflow `uint256` causing the LP position to be locked in `UniswapV3Staker`Integer overflow/underflow$0
- Maia DAO Ecosystem: If a STRATEGY TOKEN is "Toggled off" STRATEGIES will still be able to withdraw, but returning of tokens with `replenishReserves` will be disabled.Access control$0
- Maia DAO Ecosystem: A malicious user can set any contract as a local `hToken` for an underlying token since there is no access control for `_addLocalToken`Reentrancy$0
- Maia DAO Ecosystem: Governance relies on the current `totalSupply` of `bHermes` when calculating `proposalThresholdAmount` and `quorumVotesAmount`Governance attack$0
- Maia DAO Ecosystem: `BoostAggregator` owner can set fees to 100% and steal all of the user's rewardsAccess control$0
- Maia DAO Ecosystem: DoS of `RootBridgeAgent` due to missing negation of return values for `UniswapV3Pool.swap()`Integer overflow/underflow$0
- Maia DAO Ecosystem: `BaseV2Minter` DAO reward shares are calculated wrongGovernance attack$0
- Maia DAO Ecosystem: `RootBridgeAgent.redeemSettlement` can be front-run using `RootBridgeAgent.retrySettlement`, causing redeem to DoSAccess control$0
- Maia DAO Ecosystem: A malicious user can front-run Gauges's call `addBribeFlywheel` to steal bribe rewardsFlash loan attack$0
- Maia DAO Ecosystem: `redeem()` in `beforeRedeem` is using the wrong owner parameterReentrancy$0
- Maia DAO Ecosystem: Depositing gas through `depositGasAnycallConfig` should not withdraw the `nativeToken`Bridge exploit$0
- Maia DAO Ecosystem: Branch Strategies lose yield due to wrong implementation of time limit in `BranchPort.sol`Oracle manipulation$0
- Maia DAO Ecosystem: The difference between `gasLeft` and `gasAfterTransfer` is greater than `TRANSFER_OVERHEAD`, causing `anyExecute` to always failAccess control$0
- Maia DAO Ecosystem: User may underpay for the remote call `ExecutionGas` on the root chainBridge exploit$0
- Maia DAO Ecosystem: `VirtualAccount` cannot directly send native tokensGovernance attack$0
- Maia DAO Ecosystem: `vMaia` Lacks of override in `forfeitBoost`Integer overflow/underflow$0
- Maia DAO Ecosystem: Missing the unwrapping of native token in `RootBridgeAgent.sweep()` causes fees to be stuckBridge exploit$0
- Maia DAO Ecosystem: A user can call `callOutSigned` without paying for gas by reentering `anyExecute` with Virtual AccountReentrancy$0
- Maia DAO Ecosystem: Multiple issues with `retrySettlement()` and `retrieveDeposit()` will cause loss of users' bridging depositsBridge exploit$0
- Maia DAO Ecosystem: When the `anyExecute` call is made to `RootBridgeAgent` with a `depositNonce` that has been recorded in `executionHistory`, `initialGas` and `userFeeInfo` will not be updated, which would affect the next caller of `retrySettlement`.Bridge exploit$0
- Maia DAO Ecosystem: Claiming outstanding utility tokens from `vMaia` vault DoS on `pbHermes<>bHermes` conversion rate `>` 1Governance attack$0
- Maia DAO Ecosystem: `TalosBaseStrategy#init()` lacks slippage protectionReentrancy$0
- Maia DAO Ecosystem: Removing a `UniswapV3Gauge` via `UniswapV3GaugeFactory` does not actually remove it from the `UniswapV3Staker`. The gauge still gains rewards and can be staked too (even though deprecated). Plus old stakers can game the rewards of new stake…Governance attack$0
- Maia DAO Ecosystem: `RootBridgeAgent->CheckParamsLib#checkParams` does not check that `_dParams.token` is underlying of `_dParams.hToken`Bridge exploit$0
- Maia DAO Ecosystem: An attacker can exploit the "deposit" to drain the `Ulysess Liquidity Pool`Integer overflow/underflow$0
- Maia DAO Ecosystem: In `ERC20Boost.sol`, a user can be `attached` to a gauge and have no boost balance.Governance attack$0
- Maia DAO Ecosystem: `withdrawProtocolFees()` Possible malicious or accidental withdrawal of all rewardsAccess control$0
- Maia DAO Ecosystem: Reentrancy attack possible on `RootBridgeAgent.retrySettlement()` with missing access control for `RootBridgeAgentFactory.createBridgeAgent()`Reentrancy$0
- Maia DAO Ecosystem: `MIN_FALLBACK_RESERVE` (in `BranchBridgeAgent`) doesn't consider the actual gas consumption in ``AnyCall`` contracts, which lets the user underpay the actual cost when replenishing the execution budgetAccess control$0
- Maia DAO Ecosystem: On Ulysses omnichain - `RetrieveDeposit` might never be able to trigger the `Fallback` functionBridge exploit$0
- Maia DAO Ecosystem: Due to inadequate checks, an adversary can call `BranchBridgeAgent#retrieveDeposit` with an invalid `_depositNonce`, which would lead to a loss of other users' deposits.Bridge exploit$0
- Maia DAO Ecosystem: A lack of slippage protection can lead to a significant loss of user fundsFront-running / MEV$0
- Maia DAO Ecosystem: Wrong consideration of `blockformation` period causes incorrect `votingPeriod` and `votingDelay` calculationsGovernance attack$0
- Maia DAO Ecosystem: Multiple issues with decimal scaling will cause incorrect accounting of hTokens and underlying tokensBridge exploit$0
- Maia DAO Ecosystem: The user is enforced to overpay for the `fallback` gas when calling `retryDeposit`Bridge exploit$0
- Maia DAO Ecosystem: Incorrectly reading the offset from the received data parameter to get the `depositNonce` in the `BranchBridgeAgent::anyFallback()` functionBridge exploit$0
- Maia DAO Ecosystem: Removing a `BribeFlywheel` from a Gauge does not remove the reward asset from the rewards depo, making it impossible to add a new Flywheel with the same reward tokenAccess control$0
- Maia DAO Ecosystem: `UlyssesPool.sol` does not match `EIP4626` because of the preview functionsGovernance attack$0
- Maia DAO Ecosystem: Cross-chain messaging via `Anycall` will failBridge exploit$0