Rio Network — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Rio Network, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Rio Network reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Front-running / MEV, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Rio Network
- Front-running / MEV findings disclosed against Rio Network
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Rio Network: Slashing penalty is unfairly paid by a subset of users if a deficit is accumulated.
Rio's withdraw queue, in settleEpochFromEigenLayer(), computes assetsReceived from the raw ETH returned by EigenLayer's completeQueuedWithdrawal, without accounting for a possible negative share deficit in the EigenPodManager. If validators are slashed on the consensus layer while their ETH is queued for withdrawal, that deficit is silently absorbed by the first cohort that settles, while later cohorts settle at full value. The result is an unfair wealth transfer: the PoC shows cohort 0 receiving 0 ETH (paying the entire 8 ETH penalty) while cohort 1 receives its full 31.99 ETH. The finding was upheld as Medium/Unique after an escalation argued slashing was out of scope.
Rio Network: Stakers can avoid validator penalties
Rio Network is an EigenLayer restaking protocol that issues a liquid restaking token (LRT). This finding shows that a staker can request a full withdrawal via RioLRTCoordinator before an EigenPod balance drop (from validator penalties or slashing) is confirmed on EigenLayer, then trigger the instant TVL decline afterward. Because rebalancing at epoch settlement prices the withdrawal at the pre-drop value, early withdrawers escape the loss while remaining stakers absorb a disproportionate share of it — in extreme cases a small slashing can wipe out the non-front-running cohort entirely. The fix distributes penalties to all LRT holders withdrawn in the epoch including those who requested before the drop.