Olas — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Olas, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 26
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 26 closed, publicly disclosed Olas reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Flash loan attack, Access control, Reentrancy, Bridge exploit, Governance attack, across Move, EVM-Solidity, Solana-Rust. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Flash loan attack findings disclosed against Olas
- Access control findings disclosed against Olas
- Reentrancy findings disclosed against Olas
- Bridge exploit findings disclosed against Olas
- Governance attack findings disclosed against Olas
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Olas: Changing VoteWeighting contract can result in lost staking incentives
The Dispenser contract contains a logic flaw where updating the VoteWeighting contract address can lead to the permanent loss of accrued staking incentives for nominees. By failing to migrate or safeguard the state tracking of claimed epochs, the system allows the claim history to be reset when a nominee is re-registered after a manager change. This enables malicious actors to overwrite a nominee's last-claimed epoch with the current epoch, effectively burning all unclaimed historical rewards for that user.
Olas: Arbitrary tokens and data can be bridged to `GnosisTargetDispenserL2` to manipulate staking incentives
The GnosisTargetDispenserL2 contract in the Olas protocol is vulnerable to unauthorized state manipulation because its cross-chain message handler fails to verify the sender of incoming transactions. An attacker can transmit arbitrary tokens and malicious staking data via the Omnibridge to the L2 contract. Because the contract lacks origin authentication, it processes this fraudulent payload as legitimate data, allowing the attacker to manipulate staking incentive distributions and potentially misappropriate withheld funds.
Olas: `checkpoint` function is not called before staking which can cause loss of rewards for already staked services
The staking mechanism in the Olas protocol fails to properly update reward state before allowing new services to stake. By omitting a checkpoint call at the start of the stake function, the protocol uses stale reward data, which permits incoming participants to dilute the rewards accrued by existing service providers. This logic flaw allows for an unintended redistribution of rewards, directly impacting the expected earnings of active stakers.
Olas: Staked service will be irrecoverable by owner if not an ERC721 receiver
The Olas StakingBase contract enables users to stake services represented by ERC721 tokens. When withdrawing staked services, the contract utilizes the safeTransferFrom method to return the NFT to the depositor. This method enforces an interface check, requiring the recipient to support the ERC721TokenReceiver interface; if the depositor is a contract that does not implement this interface, the transfer reverts, causing the service NFT to be permanently locked within the protocol and rendering it irrecoverable by the owner.
Olas: Users will lose all ETH sent as `cost` parameter in transactions to and from Optimism
The Olas protocol's OptimismDepositProcessorL1 contract mistakenly attempts to cover message delivery fees by forwarding ETH as a value to the Optimism messaging bridge. This design is incompatible with the Optimism protocol, which covers message delivery through gas consumption on the source chain rather than explicit ETH transfers to the messenger. As a result, any funds users provide to cover these expected costs are erroneously sent to the L2 destination contract, where they remain permanently locked and inaccessible to the user.
Olas: Adding staking instance as nominee before it is created
An attacker can perform a Denial of Service (DoS) attack by registering predicted staking contract addresses as nominees in the reward system before they are actually deployed. By setting an early epoch as the 'last claimed' milestone for these future contracts, the attacker forces the system to iterate through a large range of non-existent reward periods whenever the legitimate instance owner attempts to claim incentives. This unnecessary loop leads to excessive gas consumption, potentially causing the claim transactions to revert and rendering reward distribution inaccessible for affected instances.
All reports in this group
- Olas: Attacker can make claimed staking incentives irredeemable on Gnosis ChainBridge exploit$0
- Olas: Blocklisted or paused state in staking token can prevent service owner from unstakingReentrancy$0
- Olas: Refunds for unconsumed gas will be lost due to incorrect refund chain IDBridge exploit$0
- Olas: Unstake function reverts because of use of outdated/stale `serviceIds` arrayReentrancy$0
- Olas: Incorrect handling of last nominee removal in `removeNominee` functionInteger overflow/underflow$0
- Olas: Non-normalized amounts sent via Wormhole lead to failure to redeem incentivesInteger overflow/underflow$0
- Olas: Loss of incentives if total weight in an epoch is zeroBridge exploit$0
- Olas: Attacker can cancel claimed staking incentives on ArbitrumAccess control$0
- Olas: StakingToken.sol doesn't properly handle FOT, rebasing tokens or those with variable which will lead to accounting issues downstreamLogic error$0
- Olas: Unauthorized claiming of staking incentives for retainerAccess control$0
- Olas: Less active nominees can be left without rewards after an year of inactivityGovernance attack$0
- Olas: Permanent DOS in `liquidity_lockbox` for under $10Logic error$0
- Olas: Wrong invocation of Whirpools's updateFeesAndRewards will cause it to always revertLogic error$0
- Olas: Griefing attack on `liquidity_lockbox` withdrawals due to lack of minimum depositLogic error$0
- Olas: Missing slippage protection in `liquidity_lockbox::withdraw`Front-running / MEV$0
- Olas: Bonds created in year cross epoch's can lead to lost payoutsGovernance attack$0
- Olas: LP rewards in `liquidity_lockbox` can be arbitragedFlash loan attack$0
- Olas: Withdrawals can be frozen by creating null depositsInteger overflow/underflow$0
- Olas: Withdraw amount returned by `getLiquidityAmountsAndPositions` may be incorrectBridge exploit$0
- Olas: CM can `delegatecall` to any address and bypass all restrictionsAccess control$0