Orderly Solana Vault Contract — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Orderly Solana Vault Contract, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Orderly Solana Vault Contract reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Access control, across Solana-Rust. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Access control findings disclosed against Orderly Solana Vault Contract
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Orderly Solana Vault Contract: A malicious user can withdrawals another user's money
Orderly Network's Solana vault uses a single shared PDA signing authority to authenticate cross-chain withdrawal messages received via LayerZero's OAppLzReceive. Because the vault authority seeds are identical for every user and the withdrawn funds' destination wallet is never checked against the user who initiated the withdrawal, any caller who can front-run a legitimate withdrawal message can have the vault sign and execute the withdrawal into their own account. A malicious user can therefore steal the entire amount being withdrawn from another user's position at no cost to themselves. The protocol acknowledged and fixed the issue by adding a check that binds the withdrawal recipient to the receiver specified in the payload.
Orderly Solana Vault Contract: [H-1]
The Orderly Solana vault's deposit instruction never enforces that the token actually transferred into the vault matches the mint the vault is configured to accept. Because the user-supplied token_hash is recorded and passed to the destination chain without validation, an attacker can deposit a worthless token while the program records and broadcasts that USDC-equivalent value crossed the bridge, minting the attacker free USDC on the other chain and draining the vault.