NextGen — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for NextGen, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 17
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 17 closed, publicly disclosed NextGen reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Oracle manipulation, Integer overflow / underflow, Reentrancy, Access control, across EVM-Solidity, Move. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against NextGen
- Oracle manipulation findings disclosed against NextGen
- Integer overflow / underflow findings disclosed against NextGen
- Reentrancy findings disclosed against NextGen
- Access control findings disclosed against NextGen
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
NextGen: `MinterContract::payArtist` can result in double the intended payout
The NextGen protocol contains a critical logic error in the MinterContract that can lead to excessive royalty payouts, effectively doubling the intended distribution. The issue arises because the system maintains separate, unsynchronized state variables for global royalty splits and detailed artist address allocations. An admin can manipulate these settings, bypassing the protocol's validation checks to trigger a payout that rewards both the team and the artist based on conflicting, stale allocation configurations.
NextGen: Auction winner can prevent payments via `safeTransferFrom` callback
The auction finalization process in the NextGen protocol is susceptible to a denial-of-service attack. A malicious auction winner can provide a contract address as the recipient of the NFT, which triggers a callback during the safeTransferFrom process. By forcing this callback to revert, the attacker prevents the contract from completing the distribution of funds, effectively locking the winning bid payment and all other participants' refunds inside the contract. This behavior violates the protocol's core invariant that all participants must be refunded and the owner paid, potentially leading to permanent loss of funds or enabling a ransom-style attack.
NextGen: The `RandomizerVRF` and `RandomizerRNG` do not produce hash value.
The NextGen protocol's Randomizer contracts were found to be using an insecure method to finalize token hashes, which directly compromised the quality of randomness for minted NFTs. By using a direct bytes32 conversion on concatenated inputs instead of a cryptographic hash function, the contracts failed to distribute the randomness across the full possible range of values. This shortcoming allows for potential statistical biases, such as monobit bias from external randomness sources, to persist in the final token hash, undermining the intended design of the NFT minting process.
NextGen: Multiple mints can brick any form of `salesOption` 3 mintings
The NextGen protocol's 'salesOption' 3 contains a critical logic error in its minting schedule implementation. The protocol incorrectly uses the total global circulating supply of a collection to calculate the allowed timing for mints, rather than the supply specific to the current minting phase. This leads to an artificial, future-dated 'lastMintDate' when multiple minting phases are used. As a result, subsequent attempts to mint cause an integer underflow during the timestamp calculation, which reverts the transaction and effectively bricks the minting process for that collection.
NextGen: Attacker can reenter to mint all the collection supply
The NextGen protocol contained a reentrancy vulnerability in the `MinterContract::mint` function that allowed attackers to bypass collection purchase limits. Because the contract performed external minting interactions before updating the internal state variables responsible for tracking per-address mint counts, an attacker could repeatedly re-enter the mint function within a single transaction. This flaw enabled malicious users to mint the entire supply of an NFT collection.
NextGen: Permanent DoS due to non-shrinking array usage in an unbounded loop
The NextGen protocol utilizes unbounded arrays to store auction bid histories in its `AuctionDemo.sol` contract. These arrays grow monotonically as participants place bids and are never pruned. Consequently, several critical administrative and informational functions are forced to iterate through the entire history of bids, creating a vulnerability where an attacker can inflate the array size through small, repetitive bids until the computational cost of iteration exceeds the block gas limit, causing permanent denial of service for the auction.
All reports in this group
- NextGen: If an airdrop happens before a mint the price could skyrocketLogic error$0
- NextGen: `getPrice` `salesOption` 2 can round down to the lower barrier, skipping the last time periodInteger overflow/underflow$0
- NextGen: Bidder Funds Can Become Unrecoverable Due to 1 second Overlap in `participateToAuction()` and `claimAuction()`Logic error$0
- NextGen: Adversary can block `claimAuction()` due to push-strategy to transfer assets to multiple biddersLogic error$0
- NextGen: Unchecked return value of low-level `call()/delegatecall()`Logic error$0
- NextGen: Auction payout goes to `AuctionDemo` contract owner, not the token ownerLogic error$0
- NextGen: Attacker can drain all ETH from `AuctionDemo` when `block.timestamp == auctionEndTime`Reentrancy$0
- NextGen: Artist signatures can be forged to impersonate the artist behind a collectionAccess control$0
- NextGen: Vulnerability in `burnToMint` function allows double use of NFTReentrancy$0
- NextGen: User funds sent in excess are not refundedLogic error$0
- NextGen: On a Linear or Exponential Descending Sale Model, a user that mints on the last `block.timestamp` mints at an unexpected price.Logic error$0