Munchables — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Munchables, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 6
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 6 closed, publicly disclosed Munchables reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Integer overflow / underflow, Logic error, across EVM-Solidity, Move. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Integer overflow / underflow findings disclosed against Munchables
- Logic error findings disclosed against Munchables
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Munchables: in `farmPlots()` an underflow in edge case leading to freeze of funds (NFT)
The Munchables protocol is susceptible to a denial-of-service attack caused by an integer underflow triggered during a global configuration change. When the PRICE_PER_PLOT value is increased, a landlord's total plot count may drop below the ID of currently active user plots. The logic in _farmPlots attempts to calculate farming rewards using an outdated landlord timestamp, which results in a negative value when subtracted from the user's last toil date, causing the transaction to revert. This effectively locks user funds and prevents them from interacting with the farming system.
Munchables: Single plot can be occupied by multiple renters
The LandManager contract contains a logic flaw in the transferToUnoccupiedPlot function that fails to synchronize the token's internal state after a move. By failing to update the plotId field in the ToilerState struct, the contract continues to associate the token with its original plot despite marking it as vacated in the occupancy mapping. This discrepancy can be exploited to bypass system checks, leading to inaccurate reward calculations and the potential for unauthorized multiple-occupancy of plots.
Munchables: Miscalculation in `_farmPlots` function could lead to a user unable to unstake all NFTs
The Munchables protocol contained an arithmetic error in the _farmPlots function, which calculates staking rewards. When certain combinations of staking realms and rarity resulted in a negative bonus, the reward calculation produced an invalid negative value that, when cast to an unsigned integer, created a near-maximal uint256 value. This triggered an arithmetic overflow in subsequent tax calculations, causing the unstaking transaction to revert and preventing users from withdrawing their NFTs from the protocol.
Munchables: Failure to update dirty flag in `transferToUnoccupiedPlot` prevents reward accumulation on valid plot
The 'transferToUnoccupiedPlot' function in the Munchables 'LandManager' contract fails to update the asset's 'dirty' status when a user migrates their NFT to a valid plot. Because the 'dirty' flag remains set to 'true', the protocol's farming mechanism continues to exclude the asset from reward distribution, effectively locking the user out of potential earnings. This logic error causes a permanent state of reward denial for any asset that was previously marked as dirty, even after the underlying cause for that status has been resolved via transfer.
Munchables: Users can farm on zero-tax land if the landlord locked tokens before the LandManager deployment
The Munchables protocol contains a logic flaw where users can stake NFTs on land that has not been properly initialized, resulting in a 0% tax rate. Because the protocol does not enforce the initialization of plot metadata at the time of staking, the initial zero-value tax rate is cached in the user's staking state. This allows stakers to avoid paying landlord taxes until their next harvest, even after the landlord initializes the plot metadata.
Munchables: When `LockManager.lockOnBehalf` is called from `MigrationManager`, the user's `reminder` will be set to 0, resulting in fewer received `MunchableNFTs`
In Munchables, the private `_lock` function in LockManager deliberately skips the remainder and NFT-count calculation whenever `msg.sender` is the MigrationManager. Because `lockedToken.remainder` is written back after that guarded block, the migration path overwrites any previously accumulated leftover token amount with 0, permanently discarding tokens that would otherwise have accumulated toward minting an additional MunchableNFT. The included PoC shows that after locking 1.9 ETH, unlocking a portion, and then migrating 1 ETH, a subsequent 0.2 ETH lock yields only a single unrevealed NFT and the post-migration unlock reverts because the unlock timestamp was also reset. The impact is a permanent economic loss of MunchableNFTs for migrating users.