Peapods — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Peapods, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Peapods reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Peapods
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Peapods: Pod DoS if the LEAVE_AS_PAIRED_LP_TOKEN option is enabled
Peapods' fee-processing path distributes bond/debond swap fees through the TokenRewards contract via depositFromPairedLpToken. When the LEAVE_AS_PAIRED_LP_TOKEN config flag is set, fees are deposited as PAIRED_LP_TOKEN without first being swapped into rewardsToken, and _depositRewards reverts whenever there are no stakers (totalShares == 0) and the deposited token differs from rewardsToken. Consequently, once a pod has accrued fees and liquidity exists in the pool but nobody has staked, every debond and stake transaction that triggers the pre-swap fee process reverts. Because the V2 pool retains permanently-minted dead shares even if all liquidity is removed, the pod enters an unrecoverable state that locks user funds, constituting a permanent DoS.
Peapods: Vault inflation attack in `AutoCompoundingPodLp` is possible due to incorrectly minting dead shares
Peapods' AutoCompoundingPodLpFactory mints the anti-inflation minimum deposit of 1e3 shares to msg.sender at deployment instead of to a dead address, so those shares are withdrawable and the inflation protection fails. An attacker who frontruns deployment keeps the initial share, transfers a reward token to bump total assets, and then iterates deposits of (2*totalAssets-1) with withdrawals of 1 asset to exponentially inflate share price while share supply stays at 1. When a genuine depositor arrives, their deposit rounds down to a single share, which the attacker redeems, converting most of the victim's deposit into profit. A verified Foundry PoC shows the attacker gaining ~3.92e18 units and the victim losing the identical amount.