Olympus On-Chain Governance — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Olympus On-Chain Governance, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 3
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 3 closed, publicly disclosed Olympus On-Chain Governance reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Governance attack, Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Governance attack findings disclosed against Olympus On-Chain Governance
- Logic error findings disclosed against Olympus On-Chain Governance
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Olympus On-Chain Governance: High risk checks can be bypassed with extra `calldata` padding
Olympus On-Chain Governance's `GovernorBravoDelegate._isHighRiskProposal()` determines quorum thresholds by inspecting transaction calldata lengths and the kernel `executeAction` selector with strict byte-equality checks. Solidity ignores trailing bytes beyond the declared arguments, so an attacker proposing a genuine kernel action can append padding bytes to the calldata; the check then fails to classify the proposal as high-risk, letting it pass with the lower standard quorum instead of the high-risk quorum. A supplied Foundry PoC demonstrates a kernel `executeAction` call with one extra byte being mis-categorized and the assertion in the test failing. The judge ruled the finding valid and the team fixed it in PR #299 by reverting when calldata length does not match the known expected size for an `executeAction` call.
Olympus On-Chain Governance: Nobody can cast for any proposal
GovernorBravoDelegate.castVoteInternal queries the voter's live voting power via gohm.getPriorVotes(voter, block.number). The gOHM token's getPriorVotes strictly requires its blockNumber argument to be strictly less than block.number (the requested checkpoint must already be determined), so passing block.number unconditionally triggers a revert. As a result every voting entry point — castVote, castVoteWithReason, and castVoteBySig — always reverts and no proposal can ever receive a vote, permanently bricking the governance contract's core functionality. Because the timelock can only pull admin rights once it is invoked through this same broken voting flow, the newly-deployed governance can never become operational administrator, which is why Sherlock ultimately adjudicated it as a Medium (DoS, no direct fund loss possible) despite an escalation attempting to raise it to High.
Olympus On-Chain Governance: Post-proposal vote quorum/threshold checks use a stale total supply value
OlympusDAO's on-chain Governor Bravo fork computes proposal quorum and threshold cutoffs from the gOHM total supply at the moment of proposal creation and stores those raw values, then checks the eventual vote tally against the locked-in numbers. Because gOHM supply is elastic (dynamic mint/burn), the stored cutoffs drift out of alignment with the live supply, so a proposal that had sufficient votes at creation can fail quorum later through no fault of the proposer. Beyond a general voting DoS, if supply collapses below precision floors the hard-coded percentage quorums round to zero, letting remaining holders pass anything and potentially drain the treasury. The finding was upheld as medium and fixed by splitting off an activate() step with a grace period, an emergencyPropose() path for the veto guardian, and a minimum-supply cutoff.