Salty.IO — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Salty.IO, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 35
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 35 closed, publicly disclosed Salty.IO reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Integer overflow / underflow, Governance attack, Oracle manipulation, Access control, Reentrancy, across EVM-Solidity, Move. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Integer overflow / underflow findings disclosed against Salty.IO
- Governance attack findings disclosed against Salty.IO
- Oracle manipulation findings disclosed against Salty.IO
- Access control findings disclosed against Salty.IO
- Reentrancy findings disclosed against Salty.IO
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Salty.IO: The user who withdraws liquidity from a particular pool is able to claim more rewards than they should by carefully selecting a `decreaseShareAmount` value such that the `virtualRewardsToRemove` is rounded down to zero
Salty.IO's staking contract was vulnerable to an incentive extraction bug during liquidity withdrawal due to improper rounding in reward calculations. The protocol incorrectly performed integer division when determining the amount of virtual rewards to subtract from a user's claim, allowing a user to force the subtraction to zero by withdrawing in small, precise increments. This flaw enabled attackers to unfairly claim virtual rewards they were not eligible for, depleting the protocol's rewards pool through repeated small-volume withdrawals.
Salty.IO: Remove Liquidity has missing reserve1 DUST check, which can make reserve1 to be less than DUST
The Pools contract at Salty.IO contained a critical validation flaw in the removeLiquidity function intended to protect pool reserves. A typo in the require statement caused the contract to check reserve0 twice, completely omitting the check for reserve1. This allowed liquidity removal operations to leave reserve1 at amounts below the required DUST threshold, potentially destabilizing pool ratios or causing failures in subsequent operations like swaps.
Salty.IO: Adversary can prevent updating price feed addresses by creating poisonous proposals ending in `_confirm`
The Salty.IO protocol's DAO governance mechanism was vulnerable to a denial-of-service attack due to predictable ballot naming conventions. By creating proposals with a specific '_confirm' suffix, attackers could block legitimate administrative actions, including the necessary updating of price feed contract addresses. This prevented the DAO from managing critical protocol parameters, which could have led to outdated or incorrect data being used in lending and liquidation operations.
Salty.IO: If there is only one USDS borrower, he can never be liquidated
The Salty protocol contained a logic flaw that prevented the liquidation of sole borrowers in their stablecoin system. The protocol's liquidity removal mechanism enforced a minimum 'dust' threshold on pool reserves, which caused any attempt to liquidate a sole collateral provider to revert because the process emptied the pool entirely. This created a critical economic risk where a single borrower could accumulate bad debt that the protocol was unable to clear. The issue was confirmed and subsequently addressed through a protocol-wide change that removed the affected stablecoin module.
Salty.IO: Minimium Collateral Check Can Be Bypassed
Salty.IO contained a logic error where minimum collateral requirements were only enforced during loan creation, not during collateral withdrawals. This allowed users to open a compliant loan and subsequently withdraw collateral until the position size fell below the threshold for profitable liquidation. Because liquidators are incentivized by a fixed 5% fee, these small positions become uneconomical to liquidate, creating a risk of unrecoverable bad debt for the protocol. This issue has been fully addressed by the project, which removed the entire stablecoin and lending infrastructure.
Salty.IO: Attacker Can Inflate LP Position Value To Create a Bad Debt Loan
Salty.IO's lending mechanism was vulnerable to a collateral valuation flaw where LP tokens were priced based on manipulated pool reserves. By skewing the token ratios in the pool, an attacker could artificially inflate the USD-denominated value of their LP tokens to borrow more USDS than the collateral was actually worth. This design flaw created a systemic risk of bad debt, which the team ultimately addressed by completely removing the USDS stablecoin and its associated collateral infrastructure.
All reports in this group
- Salty.IO: StakingRewards pools are not given their promised share of rewards due to incorrect calculationGovernance attack$0
- Salty.IO: Development Team might receive less SALT because there is no access control on `VestingWallet#release()`Access control$0
- Salty.IO: Creation of token whitelisting proposals can be DOS'dReentrancy$0
- Salty.IO: Salt Rewards - Rewards related to Arbitrage profits for pools can be lostPrice manipulation$0
- Salty.IO: MinShares Slippage Parameters Are Ineffective For Initial DepositFront-running / MEV$0
- Salty.IO: Reusing a SALT that has already been used for voting can allow a malicious proposal to pass and compromise the protocolLogic error$0
- Salty.IO: `_getUniswapTwapWei()` will show incorrect price for negative ticks cause it doesn't round up for negative ticksOracle manipulation$0
- Salty.IO: DOS of proposals by abusing ballot names without important parametersLogic error$0
- Salty.IO: Incorrect calculation to check remaining ratio after reward in StableConfig.solOracle manipulation$0
- Salty.IO: First depositor can break staking-rewards accountingLogic error$0
- Salty.IO: Incorrect assumption in PoolMath.sol can cause underflow when zapping is usedInteger overflow/underflow$0
- Salty.IO: SALT staker can get extra voting power by simply unstaking their xSALTGovernance attack$0
- Salty.IO: Suboptimal arbitrage implementationInteger overflow/underflow$0
- Salty.IO: No proposal time limit traps sponsors of unpopular proposalsReentrancy$0
- Salty.IO: User can evade `liquidation` by depositing the minimum of tokens and gain time to not be liquidatedReentrancy$0
- Salty.IO: First Liquidity provider can claim all initial pool rewardsLogic error$0
- Salty.IO: Some rewards from POL will not be send to team wallet nor burnedGovernance attack$0
- Salty.IO: Unwhitelisting does not clear _arbitrageProfits, so re-whitelisting may result in an unfair distribution of liquidity rewardsGovernance attack$0
- Salty.IO: When forming POL the DAO will end up stucked with DAI and USDS tokens that cannot handleGovernance attack$0
- Salty.IO: Persistent Contract Call revert prevents finalizing a ballotGovernance attack$0
- Salty.IO: Attacker can take advantage of Chainlink price not occuring within it's 60 minute heartbeat to make PriceAggregator calls failOracle manipulation$0
- Salty.IO: PriceFeed is likely to be disabled in times of volatility, causing liquidations and borrows to freezeLogic error$0
- Salty.IO: The use of spot price by CoreSaltyFeed can lead to price manipulation and undesired liquidationsOracle manipulation$0
- Salty.IO: Ballots not yet past their deadline are incorrectly looped too by tokenWhitelistingBallotWithTheMostVotes()Governance attack$0
- Salty.IO: Caller of Upkeep may skip step 11 to save gasGovernance attack$0
- Salty.IO: changeWallets() can be confirmed immediately after proposalWallets() by manipulating activeTimelock beforehandGovernance attack$0
- Salty.IO: formPOL lacks slippage and deadline protectionOracle manipulation$0
- Salty.IO: When borrowers repay USDS, it is sent to the wrong address, allowing anyone to burn Protocol Owned Liquidity and build bad debt for USDSLogic error$0
- Salty.IO: Impossible to change managed wallets with `proposeWallets` after first rejectionGovernance attack$0