Revert Lend — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Revert Lend, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 27
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 27 closed, publicly disclosed Revert Lend reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Reentrancy, Access control, Logic error, Oracle manipulation, Front-running / MEV, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Reentrancy findings disclosed against Revert Lend
- Access control findings disclosed against Revert Lend
- Logic error findings disclosed against Revert Lend
- Oracle manipulation findings disclosed against Revert Lend
- Front-running / MEV findings disclosed against Revert Lend
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Revert Lend: Risk of reentrancy `onERC721Received` function to manipulate collateral token configs shares
A reentrancy vulnerability in Revert Lend's V3Vault smart contract allows malicious borrowers to artificially inflate internal collateral debt share accounting during Uniswap V3 position transformations. When transforming a position, `V3Vault.onERC721Received` triggers an external call to return the old NFT prior to finalizing state updates for the new position token. An attacker can hijack execution via the ERC721 transfer callback to call `borrow`, causing internal debt counters (`totalDebtShares`) to double-count debt additions. By repeatedly executing this sequence, an attacker can exceed the protocol's collateral value limit, permanently blocking legitimate users from borrowing and disabling interest accrual.
Revert Lend: `V3Utils.execute()` does not have caller validation, leading to stolen NFT positions from users
A missing caller validation in Revert Lend's `V3Utils.execute()` function allows unauthorized accounts to execute arbitrary operations on approved Uniswap V3 position NFTs. Because interaction with `V3Utils` requires a two-step process—first approving the utility contract on the NonfungiblePositionManager and then calling `execute()`—approved positions are vulnerable to front-running. An attacker can back-run the owner's approval call and trigger `V3Utils.execute()` with custom parameters that drain all underlying liquidity and route the proceeds to the attacker's wallet, resulting in complete theft of the position's assets.
Revert Lend: `V3Vault::transform` does not validate the `data` input and allows a depositor to exploit any position approved on the transformer
A parameter validation flaw in Revert Lend's `V3Vault.transform()` allows any vault position owner to execute arbitrary actions on external positions delegated to Revert transformers. When calling `transform()`, `V3Vault` validates vault ownership for the `tokenId` argument provided directly in the caller's function signature, but fails to check whether the `tokenId` encoded inside the `data` calldata matches it. An attacker can pass their own valid vault token ID to bypass vault authorization while encoding a target user's external position token ID inside the calldata. This grants unauthorized attackers the ability to trigger transformer logic on non-vault positions, enabling them to siphon reward fees or trigger unfavorable swaps that result in severe loss of user funds.
Revert Lend: An attacker can easily bypass the collateral value limit factor checks
Revert Lend enforces collateral value limits via `_updateAndCheckCollateral()` during borrowing, ensuring total utilized collateral does not exceed configured parameters. However, the system fails to re-evaluate these collateral checks when users withdraw deposited lending assets. An attacker can exploit this oversight in a single transaction by temporarily depositing liquidity, borrowing funds up to the newly expanded threshold, and immediately withdrawing their deposited tokens. This leaves the vault in an over-leveraged state beyond configured limits, causing downstream integration routines like the AutoRange automator to consistently revert.
Revert Lend: Owner of a position can prevent liquidation due to the `onERC721Received` callback
A vulnerability in Revert Lend's liquidation mechanism allows malicious position owners to prevent their under-collateralized positions from being liquidated. When a liquidation occurs, `_cleanUpLoan()` attempts to return the Uniswap LP NFT back to the position owner using `safeTransferFrom`. If the position owner is a contract that intentionally reverts or returns an unexpected selector from `onERC721Received`, the entire liquidation transaction reverts, causing bad debt to accrue unpreventably in the protocol.
Revert Lend: `_getReferencePoolPriceX96()` will show incorrect price for negative tick deltas in current implementation cause it doesn't round up for them
A logic flaw in Revert Lend's `V3Oracle._getReferencePoolPriceX96()` function leads to incorrect oracle TWAP calculations when computing reference pool prices for negative tick deltas. Unlike standard Uniswap V3 Oracle library implementations, the contract performs standard integer division without rounding down when the tick cumulative delta is negative and has a remainder. This causes integer division to truncate towards zero, resulting in a higher tick value than expected. Consequently, the oracle returns an overstated reference price, exposing the protocol to price manipulation and arbitrage opportunities during collateral valuations.
All reports in this group
- Revert Lend: `AutoRange` execution can be front-ran to avoid protocol fee, causing loss for protocolFront-running / MEV$0
- Revert Lend: Incorrect liquidation fee calculation during underwater liquidation, disincentivizing liquidators to participateLogic error$0
- Revert Lend: Liquidation reward sent to msg.sender instead of recipientLogic error$0
- Revert Lend: `setReserveFactor` fails to update global interest before updating reserve factorAccess control$0
- Revert Lend: User might execute `PositionToken` of token set by previous token ownerAccess control$0
- Revert Lend: Users' newly created positions can be prematurely closed and removed from the vault directly after they are createdAccess control$0
- Revert Lend: `V3Vault.sol` permit signature does not check receiving token address is USDCSignature replay$0
- Revert Lend: Large decimal of `referenceToken` causes overflow at oracle price calculationOracle manipulation$0
- Revert Lend: `dailyDebtIncreaseLimitLeft` is not updated in `liquidate()`Logic error$0
- Revert Lend: `DailyLendIncreaseLimitLeft` and `dailyDebtIncreaseLimitLeft` are not adjusted accuratelyLogic error$0
- Revert Lend: Tokens can't be removed as a collateral without breaking liquidations and other core functionsOracle manipulation$0
- Revert Lend: Users can lend and borrow above allowed limitationsLogic error$0
- Revert Lend: Users's tokens stuck in `AutoCompound` after Vault is deactivatedReentrancy$0
- Revert Lend: No `minLoanSize` means liquidators will have no incentive to liquidate small positionsLogic error$0
- Revert Lend: Due to interest rates update method, Interest-Free Loans are possible and the costs of DoS are reducedFlash loan attack$0
- Revert Lend: Lack of safety buffer in `_checkLoanIsHealthy` could subject users who take out the max loan into a forced liquidationOracle manipulation$0
- Revert Lend: `V3Vault` is not ERC-4626 compliantLogic error$0
- Revert Lend: Users cannot stop loss in AutoRange and AutoExitOracle manipulation$0
- Revert Lend: `V3Oracle` susceptible to price manipulationOracle manipulation$0
- Revert Lend: `AutoExit` could receive a reward calculated from the entire position's fund even if `onlyFee` is true in `AutoExit.execute()`Logic error$0
- Revert Lend: Wrong global lending limit check in `_deposit` functionLogic error$0