Notional Update #5 — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Notional Update #5, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Notional Update #5 reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Notional Update #5
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Notional Update #5: Unexpected behavior when calling certain ERC4626 functions
Notional's wrapped-fCash contract implements an ERC4626 interface whose valuation depends on the global settlement state of matured fCash positions. Because settlement is only triggered when the first account settles, there is a window after maturity where `pr.supplyFactor` is still zero. In that window `_getMaturedCashValue` returns zero, so `totalAssets()` collapses to zero, which propagates to `convertToAssets`, `previewRedeem`, `maxWithdraw`, `convertToShares` and `previewWithdraw`, causing either misleading zero valuations or reverts for any integrator. The finding was upheld as Medium; the maintainers fixed it so the affected functions revert while the settlement rate is unset rather than returning zero.
Notional Update #5: Rebalance might be skipped even if the external lending is unhealthy
Notional's `_isExternalLendingUnhealthy` function in TreasuryAction.sol computes the off-target percentage of external lending deviation using an incorrect denominator (current + target instead of target alone), which systematically underestimates the deviation. For example, when target is 100 and current is 90, the code reports 5.26% instead of the correct 10%. This underestimation can cause the protocol to skip a rebalancing even when existing external lending is unhealthy, weakening the liquidity safety mechanism that guards against withdrawal and liquidation issues.