Open Dollar — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Open Dollar, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 15
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 15 closed, publicly disclosed Open Dollar reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Oracle manipulation, Integer overflow / underflow, Governance attack, across EVM-Solidity, Move. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Open Dollar
- Oracle manipulation findings disclosed against Open Dollar
- Integer overflow / underflow findings disclosed against Open Dollar
- Governance attack findings disclosed against Open Dollar
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Open Dollar: Missing debt check lets users start a debt auction of non-existent debt
The AccountingEngine contract in the Open Dollar protocol contained a logic error where it failed to validate the amount of bad debt after an internal state update, but before initiating an auction. Specifically, the check for sufficient debt was performed before calling `_settleDebt`, which could reduce the available debt below the required minimum. This allowed for the creation of debt auctions for non-existent or insufficient debt, leading to unnecessary dilution of the protocol's token and destabilizing the system's economic parameters.
Open Dollar: `ODSafeManager#allowSAFE()` cannot be executed either by the proxy contract or any other address.
The Open Dollar protocol's BasicActions contract failed to implement the necessary functions to interface with the ODSafeManager, specifically the allowSAFE() function. This prevents users from interacting with their SAFE positions through the ODProxy, effectively rendering key features such as asset transfers and collateral modifications inaccessible. Because these proxy actions are the primary way users interact with the system, this design flaw significantly limits the protocol's utility until updated.
Open Dollar: Vault721.tokenURI does not comply with ERC721 - Metadata specification
The Vault721 contract in the Open Dollar protocol fails to comply with the ERC-721 Metadata specification, which mandates that the tokenURI function must revert if an invalid or non-existent tokenId is passed as an argument. Currently, the contract executes the URI generation logic without validating token existence, leading to non-standard behavior for non-minted tokens. This oversight affects protocol compatibility with external NFT platforms and tools that expect standard-compliant ERC-721 behavior.
Open Dollar: ODSafeManager.enterSystem - Transfer wrong amount of collateral, debt
The `ODSafeManager.enterSystem` function contains a logic error in how it calculates the collateral and debt to be transferred. Instead of retrieving the assets from the source account, the contract incorrectly queries the destination's account state. This leads to erroneous calculations that cause the function to fail whenever the source and destination account states do not align.
Open Dollar: Unable to retrieve price information with CamelotRelayer contract
The CamelotRelayer contract is fundamentally broken because it incorrectly assumes that Camelot V3 liquidity pools implement the exact same interface as Uniswap V3 pools. By attempting to use the Uniswap V3 OracleLibrary, the relayer calls non-existent functions on the Camelot pools, causing constant transaction reverts. This renders the relayer incapable of providing any price information, effectively disabling any system component that depends on this oracle for accurate pricing.
Open Dollar: Approved address can approve other addresses for an owner's safe
The ODSafeManager contract contains a logic flaw where administrative permissions are inadvertently delegated. Specifically, the allowSAFE function improperly uses a modifier intended for standard Safe operations, which allows any authorized user to grant new permissions to other accounts. This enables a malicious or compromised delegate to grant unauthorized third parties full control over the owner's Safe, creating a significant security risk for users who believe they are only granting limited access.
All reports in this group
- Open Dollar: Old permissions in handlerCan mapping are still attached to the safeHandler of a transferred safeLogic error$0
- Open Dollar: SafeHandler contract doesn't have any method to call to `ODSafeManager.allowHandler()`, lead to DOS in some functionLogic error$0
- Open Dollar: Incorrect calculations for Surplus Auction creation cause massive surplus imbalancesInteger overflow/underflow$0
- Open Dollar: Decimal Limitation in CamelotRelayer and UniV3Relayer Contract DeploymentOracle manipulation$0
- Open Dollar: Mismatch between the SAFE generated debt and the amount of the system tokens minted for the userLogic error$0
- Open Dollar: Malicious users are able to bypass the Tax payment using making a Fake BasicActions ContractLogic error$0
- Open Dollar: Due to extremely short `votingDelay` and `votingPeriod`, governance is practically impossibleGovernance attack$0
- Open Dollar: `transferSAFEOwnership()` does not fully transfer ownershipLogic error$0
- Open Dollar: Collateral could be transferred to an address, which is not `SAFEHandler` managed by the `SAFEManager`Logic error$0