RadicalxChange — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for RadicalxChange, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 3
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 3 closed, publicly disclosed RadicalxChange reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against RadicalxChange
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
RadicalxChange: Currently auctioned NFTs can be transferred to a different address in a specific edge case
RadicalxChange's pco-art license NFT periodic-auction flow assumed an NFT's owner could not change while an auction was live. A configuration edge case breaks that assumption: an NFT added to the collection unminted, with tokenInitialPeriodStartTime set to a timestamp after zero but before l.initialPeriodStartTime, can be minted to a different address mid-auction. A malicious initial bidder exploits this by bidding, minting the license to a second address they control, then closing the auction, causing the contract to credit the full bid amount to the new owner's availableCollateral even though the initial bidder only paid the reduced owner-fee. That credit can then be withdrawn as ETH while the attacker keeps the NFT license, and if a privileged token-adder colludes it becomes a protocol drain.
RadicalxChange: Auction fails if the 'Honorarium Rate' is 0%
The RadicalxChange PCO Art periodic auction cannot accept any bid from a non-owner when the Creator Circle configures an Honorarium Rate of 0%. Because the protocol requires the bidder's total collateral to be strictly greater than the bid amount, and the collateral is defined as bidAmount plus the (zero) fee, the strict inequality check always reverts; even over-depositing collateral reverts via the 'Incorrect bid amount' check. This directly contradicts the project documentation advertising 0% honorarium as a legitimate configuration to mimic private ownership, making auction bidding impossible for all non-steward participants. The finding was escalated, validated as Medium with duplicate #107, and fixed by the sponsor both by changing the comparison to >= and by rejecting feeDenominator of 0 at configuration time.
RadicalxChange: Highest bidder can withdraw his collateral due to a missing check in _cancelAllBids
RadicalxChange's EnglishPeriodicAuction contract lets any bidder cancel their bids across all rounds via _cancelAllBids, and this function omits the eligibility check that _cancelBid enforces — namely that the current highest bidder cannot cancel. As a result, the leading bidder can zero out their collateral, have it returned to availableCollateral, and withdraw it while still being recorded as the highest bidder in l.highestBids. When the round closes they win the auction for free, and the shortfall is ultimately borne by the old bidder or other users, since future withdrawals can fail if the contract lacks enough funds. The maintainers fixed the issue in pull request pco-art#9 by porting the highest-bidder check into _cancelAllBids while still permitting cancellation of bids on prior rounds.