Symmio, Staking and Vesting — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Symmio, Staking and Vesting, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Symmio, Staking and Vesting reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Oracle manipulation, Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Oracle manipulation findings disclosed against Symmio, Staking and Vesting
- Logic error findings disclosed against Symmio, Staking and Vesting
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Symmio, Staking and Vesting: USDC rewards will not be distributed if `_updateRewardsStates` is triggered too often
SymmStaking accrues staking rewards using a per-second rate divided by total staked supply, with perTokenStored updated whenever any user deposits, withdraws, claims, or notifies rewards. Because reward tokens like USDC/USDT have only 6 decimals while the accounting uses 18-decimals, the per-second increments round down to zero when the reward rate per staked token is small, so frequent state updates (as often as once per block) prevent perTokenStored from ever increasing while still advancing lastUpdated. An attacker can spam these state-triggering calls to keep all accrued USDC/USDT permanently bricked in the contract rather than distributed to stakers. The adjudicated fix recognizes this as a missing upscaling (1e12 multiplier) for low-decimal reward tokens.
Symmio, Staking and Vesting: Malicious User can dilute staking Rewards to a longer timeframe
Symmio's SymmStaking contract lets anyone call notifyRewardAmount to deposit rewards. Because the reward rate is recomputed as (amount + leftover)/fixed period whenever new rewards arrive during an active period, a malicious actor can repeatedly top up a tiny dust amount (e.g. 1 wei), which keeps the nominal total nearly unchanged while the fixed one-week duration forces the effective per-second rate to drop sharply each time. Stakers then earn their entitlements far more slowly than intended. The issue was confirmed as a Sherlock medium and fixed by the protocol in SYMM-IO/token PR #4.