Smilee Finance — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Smilee Finance, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Smilee Finance reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Oracle manipulation, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Smilee Finance
- Oracle manipulation findings disclosed against Smilee Finance
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Smilee Finance: Transferring ERC20 Vault tokens to another address and then withdrawing from the vault breaks `totalDeposit` accounting which is tied to deposit addresses
Smilee Finance's Vault is an ERC20 whose per-user deposit accounting (cumulativeAmount and the global totalDeposit) assumes the depositor is the one who later withdraws those shares, but vault shares can be freely transferred between users. By transferring nearly all shares to another address and withdrawing a single wei, a user can reduce totalDeposit by their entire original deposit while withdrawing almost nothing, letting them bypass the admin-set maxDeposit cap and redeposit beyond it, or conversely inflate totalDeposit without backing assets so the vault rejects all new deposits. The protocol acknowledged the issue, Sherlock upheld it as a valid medium, and a fix commit was provided, though a follow-up review noted the fix still allows deposit-limit bypass via transfers to the vault itself with lost funds.
Smilee Finance: PositionManager will revert when trying to return back to user excess of the premium transferred from the user when minting position
In Smilee Finance's PositionManager.mint, the contract computes a preliminary premium and pre-collects it from the user, later refunding any over-collected excess. The refund path uses baseToken.safeTransferFrom(address(this), msg.sender, ...), but PositionManager never approves itself for that transfer, and on Arbitrum both USDC and USDC.e transferFrom always verify allowance even for self-transfers. The refund therefore always reverts, making the mint call fail and blocking users from opening positions. Sherlock ruled the issue Medium and confirmed it remains valid even though the condition is currently unreachable due to a separate DVP pricing bug; the team fixed it by switching to safeTransfer.