Predy — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Predy, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 11
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 11 closed, publicly disclosed Predy reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Oracle manipulation, Logic error, Reentrancy, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Oracle manipulation findings disclosed against Predy
- Logic error findings disclosed against Predy
- Reentrancy findings disclosed against Predy
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Predy: Liquidity manipulation is possible when trading
A spot price manipulation vulnerability was identified in Predy's Trade library due to its reliance on Uniswap V3's slot0 state without TWAP protection or slippage validation. When processing trades, the contract fetches instantaneous pool pricing via UniHelper, leaving the valuation vulnerable to single-block price distortion. An attacker can use flash loans or large swaps to artificially shift the Uniswap pool price right before a trade executes, leading to execution at distorted asset ratios and potential loss of protocol or user funds.
Predy: PriceFeed does not return to the correct price for quote pairs
The Predy protocol's `PriceFeed` contract contained a critical error in how it handled decimal scaling for quote pair prices. Due to the implementation of the decimal difference as a simple divisor rather than an exponential factor, the protocol generated incorrect price data. This propagated throughout the system, leading to systemic inaccuracies in vault valuation and position margin calculations for both perpetual and gamma trading markets.
Predy: One pair can steal another pair's Uniswap liquidity during `reallocate()` call if both pairs operate on the same Uniswap pool and both have the same upper and lower tick during reallocation
A logic error in Predy's liquidity reallocation mechanism allows one pair to drain liquidity belonging to another pair sharing the same Uniswap V3 pool. When multiple pairs operate on the same pool using identical upper and lower tick ranges, `reallocate()` fails to verify pair-specific ownership and instead pulls all contract-held liquidity within that tick range. Consequently, executing reallocation on an inactive pair withdraws liquidity backed by open positions in the active pair, permanently disrupting protocol accounting and freezing user positions.
Predy: Reallocation depends on the `slot0` price, which can be manipulated
In Predy's Perp library, the reallocate function checks whether an LP position is out of range by querying the instantaneous spot price directly from Uniswap V3 pool state via slot0. Because slot0 returns unweighted spot prices, malicious actors can execute swaps within a single block to artificially push the reported tick outside designated range boundaries. This forces the contract to trigger swapForOutOfRange and rebalance protocol liquidity based on distorted prices, ultimately leading to misplaced LP positions and protocol yield losses.
Predy: Incorrect price for negative ticks due to lack of rounding down
In Predy's Unihelper contract, `callUniswapObserve` derives a TWAP tick from Uniswap V3 oracle cumulative tick data using standard integer division. Because Solidity integer division rounds negative numbers toward zero rather than negative infinity, negative tick deltas with remainders produce a tick that is rounded up. This causes the protocol to compute an artificially elevated TWAP price whenever the TWAP tick is negative and not evenly divisible by the time window.
Predy: Liquidation incorrectly tries to transfer token from Market instead of liquidator if `remainingMargin` is negative
In Predy v6, liquidations performed via Market contracts fail when liquidating vaults that incur bad debt (negative remaining margin). During the finalization of a position liquidation, PredyPool attempts to transfer quote tokens from msg.sender to cover the remaining negative margin deficit. However, when called through a Market contract, msg.sender resolves to the Market contract address rather than the liquidator initiating the transaction. Because the Market contract lacks approval and quote token balances, the safeTransferFrom call reverts, preventing liquidations of insolvent vaults and allowing uncollectible debt and accrued interest to accumulate indefinitely.
All reports in this group
- Predy: Chainlink's `latestRoundData` might return stale or incorrect resultsOracle manipulation$0
- Predy: `updateIRMParams` does not call `applyInterestForToken` before updating `irmParams` which leads to incorrect calculation of interest rate for subsequent trades.Logic error$0
- Predy: Liquidators can bypass remaining negative margin check and leave the loss to the protocolOracle manipulation$0
- Predy: Possible DoS When calling `GammaTradeMarket::_removePosition` will cause user position to not be able to get liquidatedLogic error$0
- Predy: Reallocation incorrectly sends the exceed `quoteTokens` to Market contract instead of reallocatorLogic error$0