Munchables — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Munchables, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 11
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 11 closed, publicly disclosed Munchables reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Integer overflow / underflow, Logic error, Access control, Oracle manipulation, across EVM-Solidity, Move. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Integer overflow / underflow findings disclosed against Munchables
- Logic error findings disclosed against Munchables
- Access control findings disclosed against Munchables
- Oracle manipulation findings disclosed against Munchables
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Munchables: Miscalculation in `_farmPlots` function could lead to a user unable to unstake all NFTs
The Munchables protocol contained an arithmetic error in the _farmPlots function, which calculates staking rewards. When certain combinations of staking realms and rarity resulted in a negative bonus, the reward calculation produced an invalid negative value that, when cast to an unsigned integer, created a near-maximal uint256 value. This triggered an arithmetic overflow in subsequent tax calculations, causing the unstaking transaction to revert and preventing users from withdrawing their NFTs from the protocol.
Munchables: Single plot can be occupied by multiple renters
The LandManager contract contains a logic flaw in the transferToUnoccupiedPlot function that fails to synchronize the token's internal state after a move. By failing to update the plotId field in the ToilerState struct, the contract continues to associate the token with its original plot despite marking it as vacated in the occupancy mapping. This discrepancy can be exploited to bypass system checks, leading to inaccurate reward calculations and the potential for unauthorized multiple-occupancy of plots.
Munchables: Failure to update dirty flag in `transferToUnoccupiedPlot` prevents reward accumulation on valid plot
The 'transferToUnoccupiedPlot' function in the Munchables 'LandManager' contract fails to update the asset's 'dirty' status when a user migrates their NFT to a valid plot. Because the 'dirty' flag remains set to 'true', the protocol's farming mechanism continues to exclude the asset from reward distribution, effectively locking the user out of potential earnings. This logic error causes a permanent state of reward denial for any asset that was previously marked as dirty, even after the underlying cause for that status has been resolved via transfer.
Munchables: in `farmPlots()` an underflow in edge case leading to freeze of funds (NFT)
The Munchables protocol is susceptible to a denial-of-service attack caused by an integer underflow triggered during a global configuration change. When the PRICE_PER_PLOT value is increased, a landlord's total plot count may drop below the ID of currently active user plots. The logic in _farmPlots attempts to calculate farming rewards using an outdated landlord timestamp, which results in a negative value when subtracted from the user's last toil date, causing the transaction to revert. This effectively locks user funds and prevents them from interacting with the farming system.
Munchables: Invalid validation in `_farmPlots` function allowing a malicious user repeated farming without locked funds
Munchables' LandManager `_farmPlots` invalidation logic contains an off-by-one comparison error. The check `_getNumPlots(landlord) < _toiler.plotId` fails to flag a toiler farming on plot index 0 once the landlord unlocks all funds and the plot count drops to zero. Because that plot is never marked dirty, the toiler can keep calling `farmPlots` and accrue schnibble rewards indefinitely on an unfunded plot, inflating the in-game economy and granting unfair advantage. The PoC shows both toiler and landlord balances still growing after unlock, and the fix is a one-character operator change from `<` to `<=`.
Munchables: Users can farm on zero-tax land if the landlord locked tokens before the LandManager deployment
The Munchables protocol contains a logic flaw where users can stake NFTs on land that has not been properly initialized, resulting in a 0% tax rate. Because the protocol does not enforce the initialization of plot metadata at the time of staking, the initial zero-value tax rate is cached in the user's staking state. This allows stakers to avoid paying landlord taxes until their next harvest, even after the landlord initializes the plot metadata.
All reports in this group
- Munchables: User's schnibbles rewards are not harvested in the `setLockDuration` functionLogic error$0
- Munchables: When `LockManager.lockOnBehalf` is called from `MigrationManager`, the user's `reminder` will be set to 0, resulting in fewer received `MunchableNFTs`Logic error$0
- Munchables: Invalid validation allows users to unlock earlyLogic error$0
- Munchables: Malicious User can call `lockOnBehalf` repeatedly extend a users `unlockTime`, removing their ability to withdraw previously locked tokensAccess control$0
- Munchables: Missing disapproval check in `LockManager.sol::approveUSDPrice` allows simultaneous approval and disapproval of a price proposalOracle manipulation$0