Phi — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Phi, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 15
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 15 closed, publicly disclosed Phi reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Reentrancy, Logic error, Access control, Front-running / MEV, across EVM-Solidity, Move. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Reentrancy findings disclosed against Phi
- Logic error findings disclosed against Phi
- Access control findings disclosed against Phi
- Front-running / MEV findings disclosed against Phi
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Phi: Signature replay in `createArt` allows to impersonate artist and steal royalties
A signature binding flaw in the Phi protocol allows an attacker to hijack NFT creation transactions. Because the signature validation logic in 'PhiFactory::createArt' fails to include the 'CreateConfig' struct in the signed digest, attackers can intercept a valid signature and replay it with modified parameters. This enables the attacker to set themselves as the royalty recipient for new artworks, effectively stealing future royalty payments intended for the rightful artist.
Phi: `shareBalance` bloating eventually blocks curator rewards distribution
In Phi protocol's `Cred` contract, curator share balances are tracked using an `EnumerableMap`. When a curator sells all of their shares, `_updateCuratorShareBalance` sets their balance to zero instead of removing their address key from the map. As historical trading volume accumulates, the `EnumerableMap` grows indefinitely with zero-balance addresses. During reward distribution, iterating through all stored map keys consumes excessive gas via repeated `SLOAD` operations. Once roughly 4,000 unique addresses have traded shares of a given cred, the gas required to execute reward distribution exceeds the EVM block gas limit, permanently freezing reward distribution for that cred.
Phi: Forced `endTime` extension in `updateArtSettings()` allows attacker to mint more tokens
In the Phi Protocol, the `updateArtSettings()` function in the `PhiFactory` contract mandates that an `endTime` be provided that is not in the past. This requirement forces artists who are simply updating metadata or royalties after a campaign has finished to implicitly extend the `endTime` to the current block time. This action effectively resets the minting window, allowing opportunistic users to exploit the configuration update and claim tokens that should have been unavailable, thereby diluting the holders of existing tokens.
Phi: `PhiFactory:claim` potentially causing loss of funds if `mintFee` changed beforehand
A vulnerability in PhiFactory's `claim` function allows ETH handling mismatches due to incorrect external self-calls when forwarding fees. When processing claims, `PhiFactory.claim` invokes `this.merkleClaim` or `this.signatureClaim` externally, passing `mintFee` as the call value. This overrides `msg.value` in the target context and prevents `PhiFactory` from validating the actual ETH sent by the user against `mintFee`. If a user sends excess ETH after a fee reduction, the unrefunded surplus is left stranded in `PhiFactory`. Conversely, if `PhiFactory` holds leftover ETH, an attacker can invoke `claim` with zero `msg.value` and force the contract to pay the `mintFee` using protocol reserves.
Phi: Unrestricted changes to token settings allow artists to alter critical features
In the PhiFactory contract, art creators can update token settings post-minting through `updateArtSettings` without parameter validation or timing restrictions. Creators can dynamically convert liquid NFTs into non-transferable soulbound tokens, increase secondary market royalty fees up to arbitrarily high percentages, or modify metadata URIs to malicious links. These unconstrained administrative updates allow creators to lock secondary transfers or extract excessive fees from existing holders, severely impacting token utility and value.
Phi: Signature replay in `signatureClaim` results in unauthorized claiming of rewards
A cross-chain signature replay vulnerability was identified in Phi protocol's reward claiming mechanism. The `PhiFactory::signatureClaim` function fails to validate that the chain ID embedded in the authorization signature matches `block.chainid`. Although wrapper contracts attempt to sanitize the chain ID, `PhiFactory::signatureClaim` remains publicly callable without this check, enabling users to reuse valid claim signatures issued on one chain across all other supported networks to steal unauthorized NFT rewards.
All reports in this group
- Phi: Lack of data validation when users are claiming their art allows malicious user to bypass signature/merkle hash to provide unapproved `ref_`, `artId_` and `imageURI`Logic error$0
- Phi: Contract `PhiNFT1155` can't be pausedReentrancy$0
- Phi: Reentrancy in creating Creds allows an attacker to steal all Ether from the Cred contractReentrancy$0
- Phi: Incorrect fee handling prevents protocol from updating feesAccess control$0
- Phi: Refunds sent to incorrect addresses in certain casesLogic error$0
- Phi: Attacker can DOS user from selling shares of a `credId`Front-running / MEV$0
- Phi: Cred creator could cause stuck fundsAccess control$0
- Phi: Exposed `_removeCredIdPerAddress` & `_addCredIdPerAddress` allows anyone to cause issues to current holders as well as upcoming onesLogic error$0
- Phi: PhiNFT1155 contracts continue sending fees/royalties to old protocol destination addressAccess control$0