Nouns DAO - Clients Incentives — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Nouns DAO - Clients Incentives, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 3
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 3 closed, publicly disclosed Nouns DAO - Clients Incentives reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Nouns DAO - Clients Incentives
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Nouns DAO - Clients Incentives: Rewards can be stolen from other proposals and votes by extending auction revenue period with the help of bogus proposals
Nouns DAO's Client Incentives rewards module derives the auction-revenue reward period from the creationTimestamp of the last proposal in a user-supplied proposal range, without requiring that anchor proposal to be eligible. Because proposalDataForRewards() returns proposals blindly, an attacker who clears the deliberately-low proposalThresholdBPS can front-run a rival's high-attention proposal with a bogus, already-ended proposal that becomes the t.lastProposal anchor. This maximizes the auction-revenue window attributed to the attacker's clientId, diluting and effectively stealing rewards owed to rival proposal and vote owners. The lead judge upheld High severity over the sponsor's Medium proposal, and the fix moved eligibility filtering into proposalDataForRewards(), merged in PR #839 and signed off by the Lead Senior Watson.
Nouns DAO - Clients Incentives: Eligibility of cancelled proposals makes it possible for `proposalEligibilityQuorumBps` controlling actor to create multiple eligible proposals, stealing rewards from all others
Nouns DAO's client-incentives rewards subsystem counts every proposal that passes the voting quorum as eligible for proposal-writing rewards, without excluding proposals that were subsequently cancelled by their proposer. Because cancelled proposals free the proposer to immediately create a new one (bypassing the full voting lifecycle), an actor who controls more than the 10% `proposalEligibilityQuorumBps` threshold — directly or through colluding Nouns holders — can repeatedly cycle "create → vote → cancel" to manufacture many eligible proposals in a short window. Each such proposal counts toward the eligible-proposal base in `Rewards.updateRewardsForProposalWritingAndVoting()`, diluting the reward share for all other client ID owners. The impact was judged High because even a modest number of cancelled proposals can depress honest reward recipients' earnings by 2-3x.
Nouns DAO - Clients Incentives: Rewards can be allocated for less than minimal reward period with the help of bogus proposal
Nouns DAO's Client Incentives Rewards contract had a validation-ordering flaw in its reward distribution logic: the minimumRewardPeriod check was evaluated against the creation timestamp of a user-supplied lastProposal whose eligibility was never verified before the timing gate. Because proposalDataForRewards returns all proposals unfiltered, anyone with enough votes to create a proposal could front-run with a deliberate bogus (heavily voted-down or even vetoed) proposal, let it end, then use it as an anchor to distribute rewards for their own interesting proposals ahead of competing ones still waiting out the reward period. The economic impact is misallocation of auction revenue: in a window where few other eligible proposals are active and auction revenue is strong, the attacker steals reward allocation from proposals that legitimately should have gotten priority. The sponsor confirmed the finding, it was fixed in nounsDAO/nouns-monorepo PR #839, and the lead senior Watson signed off on the fix.