Metric — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Metric, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 5
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 5 closed, publicly disclosed Metric reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Oracle manipulation, across EVM-Solidity, Other. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Metric
- Oracle manipulation findings disclosed against Metric
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Metric: Premature E8 confidence flooring erases configured swap fees
AnchoredPriceProvider::_shapedQuote computes the confidence-derived half-spread as an integer delta in the oracle's coarse E8 price domain before converting to Q64.64. For a low-priced asset such as PEPE/USD, the product mid * spreadBps * confidenceParam often yields a delta strictly between zero and one E8 unit, which Solidity flooring truncates to zero — silently discarding the configured confidence widening. Because the directional band-edge rounding happens only after that information is lost, the provider returns the narrower mandatory anchored endpoints, lowering the pool's baseFeeX64 for every subsequent swap and undercharging the configured swap fee. The report demonstrates a realistic case where a 31.05 bps precision-preserving base fee collapses to 21.52 bps, omitting ~30.7% of the fee yield (about 952 quote tokens per million of fee-exclusive volume) with fully benign oracle reports and admin parameters.
Metric: Stop-loss checks can miss a 10% drawdown in a normal USDC/WBTC pool
Metric's OracleValueStopLossExtension protects LP positions against drawdowns by recording token-denominated per-share values at a fixed 1e6 scale and flooring each balance component. In a normal USDC/WBTC pool the token1 watermark lands at 8, and both the live metric and the 5% drawdown threshold round to 7 after a WBTC repricing, so the strict 'metric < threshold' comparison never triggers even though the true protected-leg drawdown reaches 10.025%. A swapper can ride that rounding gap to complete an oracle-repricing cycle and shave roughly $567.63 of principal from the LP despite the configured stop-loss.
Metric: A permissionless swapper will extract principal from exact-share liquidity providers
Metric's exact-input in-bin swap functions (buyToken0InBinSpecifiedIn and buyToken1InBinSpecifiedIn) round a small expected output to zero while still advancing the active-bin cursor to the attacker-chosen target position, leaving both bin reserves and fee accumulators unchanged. A permissionless attacker can batch hundreds of these zero-input, zero-output swaps to desynchronize the cursor from reserves, let an exact-share LP deposit at a reserve-based price, and then trade back through the artificially created interval at the real oracle midpoint to extract the victim's principal. The PoC demonstrates a LP principal loss of roughly $33 (3.31 bps on a ~$99,900 deposit) with a matching attacker profit, all at an unchanged honest oracle quote.
Metric: ChainlinkOracle cannot pay Data Streams verification fees, causing oracle updates to fail
The Metric protocol's ChainlinkOracle integration for Chainlink Data Streams sets the report verification fee to a hardcoded zero atto-value and never funds or approves the configured ERC20 billing token. Because the verifier actually bills for paid reports in production deployments (native or token fee per the network config), every otherwise-valid report submitted through updateReport() causes VerifierProxy.verify() to revert before the feed is refreshed. Once the prior report ages past the staleness window, Chainlink-backed price providers fail closed and dependent swap pools stop functioning, earning a Sherlock Medium ruling.
Metric: Discarding sub-quantum oracle precision lets low-priced assets trade below their signed value
Metric's oracle consumer floors Pyth Lazer prices to eight decimals when a feed's exponent is below -8, truncating the sub-quantum remainder without folding the discarded quantization error into the spread or uncertainty band used by the anchored price provider. Because the provider constructs its protective bid/ask band around that already downward-biased midpoint, a fresh, correct and stale-free Pyth report for a low-priced asset like SHIB can still let a permissionless swapper buy the token out of the pool below its correctly signed oracle value. In the demonstrated configuration an LP funding 25,000,000,000 SHIB (worth about $102,942.50 at the correct midpoint) loses roughly $89.70 of mark-to-market principal, which clears Sherlock's Medium thresholds of both 0.01% of affected principal and $10. The protocol team acknowledged and fixed the issue in a follow-up commit.