Olas — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Olas, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 32
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 32 closed, publicly disclosed Olas reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Access control, Governance attack, Bridge exploit, Flash loan attack, across EVM-Solidity, Move, Solana-Rust. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Olas
- Access control findings disclosed against Olas
- Governance attack findings disclosed against Olas
- Bridge exploit findings disclosed against Olas
- Flash loan attack findings disclosed against Olas
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Olas: `pointsSum.slope` Not Updated After Nominee Removal and Votes Revocation
Olas's VoteWeighting governance contract maintains a global checkpoint aggregate, pointsSum, that tracks cumulative bias and slope of delegated voting weight. When a user votes, both values are incremented, but the removeNominee and revokeRemovedNomineeVotingPower paths decrement only the bias and never adjust the matching slope. Because of this asymmetry, subsequent checkpoint and weight computations read an inflated pointsSum.slope that still counts the removed nominee's contribution, yielding incorrect voting weights for later timestamps. This distortion persists until the aggregate slope is eventually reconciled, skewing the governance-layer voting-power accounting the contract depends on. The recommended fix is to decrement the slope alongside the bias in either removal function so the aggregate stays internally consistent.
Olas: Attacker can cancel claimed staking incentives on Arbitrum
The ArbitrumDepositProcessorL1 contract contains a critical configuration error in how it initiates cross-chain messages via Arbitrum retryable tickets. By incorrectly assigning a user-controlled refund address as the ticket's cancellation authority, the contract allows any user to intentionally stall a transaction and subsequently void it entirely. This vulnerability enables an attacker to perform a permanent Denial of Service (DoS) on the claiming of staking incentives for nominees on the Arbitrum chain.
Olas: Adding staking instance as nominee before it is created
An attacker can perform a Denial of Service (DoS) attack by registering predicted staking contract addresses as nominees in the reward system before they are actually deployed. By setting an early epoch as the 'last claimed' milestone for these future contracts, the attacker forces the system to iterate through a large range of non-existent reward periods whenever the legitimate instance owner attempts to claim incentives. This unnecessary loop leads to excessive gas consumption, potentially causing the claim transactions to revert and rendering reward distribution inaccessible for affected instances.
Olas: The `msg.value - cost` for multiple cross-chain bridges are not refunded to users
Olas's L1 cross-chain deposit processors (WormholeTargetDispenserL2, WormholeDepositProcessorL1, ArbitrumDepositProcessorL1) charge callers the msg.value they supply for a cross-chain operation whose actual cost is quoted by a dynamic bridge-integration gas estimator. Because the estimate is a moving target, callers routinely send more value than the operation ultimately consumes, and the surplus (msg.value minus cost) is forwarded with the bridging call but never returned to the transaction originator. That residual value accumulates and remains permanently stuck inside the processor contract. Olas confirmed the finding, refunded the difference to tx.origin in autonolas-tokenomics pull request 159, and a warden verified the fix was applied.
Olas: Arbitrary tokens and data can be bridged to `GnosisTargetDispenserL2` to manipulate staking incentives
The GnosisTargetDispenserL2 contract in the Olas protocol is vulnerable to unauthorized state manipulation because its cross-chain message handler fails to verify the sender of incoming transactions. An attacker can transmit arbitrary tokens and malicious staking data via the Omnibridge to the L2 contract. Because the contract lacks origin authentication, it processes this fraudulent payload as legitimate data, allowing the attacker to manipulate staking incentive distributions and potentially misappropriate withheld funds.
Olas: StakingToken.sol doesn't properly handle FOT, rebasing tokens or those with variable which will lead to accounting issues downstream
The Olas protocol's StakingToken contract incorrectly manages internal accounting when interacting with fee-on-transfer, rebasing, or rounding-prone tokens, despite claiming support for these types. By updating internal records based on input parameters rather than measuring actual balance changes before and after transfers, the contract's state can desynchronize from its real-world token holdings. This leads to broken withdrawal logic, where users may be unable to claim funds because the contract reports a higher balance than it actually possesses, potentially necessitating manual recovery interventions.
All reports in this group
- Olas: Unauthorized claiming of staking incentives for retainerAccess control$0
- Olas: Attacker can make claimed staking incentives irredeemable on Gnosis ChainBridge exploit$0
- Olas: Changing VoteWeighting contract can result in lost staking incentivesFlash loan attack$0
- Olas: Unstake function reverts because of use of outdated/stale `serviceIds` arrayReentrancy$0
- Olas: `checkpoint` function is not called before staking which can cause loss of rewards for already staked servicesAccess control$0
- Olas: Non-normalized amounts sent via Wormhole lead to failure to redeem incentivesInteger overflow/underflow$0
- Olas: Users will lose all ETH sent as `cost` parameter in transactions to and from OptimismBridge exploit$0
- Olas: Staked service will be irrecoverable by owner if not an ERC721 receiverReentrancy$0
- Olas: In `retain` function, `checkpoint` nominee function is not called which can cause zero amount of tokens being retainedLogic error$0
- Olas: The `refundAccount` is erroneously set to `msg.sender` instead of `tx.origin` when `refundAccount` specified as `address(0)`Bridge exploit$0
- Olas: Less active nominees can be left without rewards after an year of inactivityGovernance attack$0
- Olas: Refunds for unconsumed gas will be lost due to incorrect refund chain IDBridge exploit$0
- Olas: Blocklisted or paused state in staking token can prevent service owner from unstakingReentrancy$0
- Olas: Removed nominee doesn't receive staking incentives for the epoch in which they were removed which is against the intended behaviourLogic error$0
- Olas: Loss of incentives if total weight in an epoch is zeroBridge exploit$0
- Olas: Incorrect handling of last nominee removal in `removeNominee` functionInteger overflow/underflow$0
- Olas: Griefing attack on `liquidity_lockbox` withdrawals due to lack of minimum depositLogic error$0
- Olas: Wrong invocation of Whirpools's updateFeesAndRewards will cause it to always revertLogic error$0
- Olas: LP rewards in `liquidity_lockbox` can be arbitragedFlash loan attack$0
- Olas: Permanent DOS in `liquidity_lockbox` for under $10Logic error$0
- Olas: Missing slippage protection in `liquidity_lockbox::withdraw`Front-running / MEV$0
- Olas: Withdraw amount returned by `getLiquidityAmountsAndPositions` may be incorrectBridge exploit$0
- Olas: Possible DOS when withdrawing liquidity from Solana LockboxBridge exploit$0
- Olas: CM can `delegatecall` to any address and bypass all restrictionsAccess control$0
- Olas: Withdrawals can be frozen by creating null depositsInteger overflow/underflow$0
- Olas: Bonds created in year cross epoch's can lead to lost payoutsGovernance attack$0