Thruster — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Thruster, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Thruster reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Thruster
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Thruster: `claimPrizesForRound` transfers the entire amount deposited for a prize regardless of the number of winners
ThrusterTreasure's claim path pays out the entire prize recorded by setPrize() to the first qualifying caller instead of splitting it across the configured winner count. Because _claimPrize unconditionally transfers the full stored WETH/USDB amounts, the first winner for a round/prize index drains the pool and locks out the other winners, whose claims then revert or pay nothing. The warden and sponsor agreed on the finding, and the proposed fix scales the amount pulled from the owner by the number of winners so each winner can be paid their share.
Thruster: Tickets can be entered after prizes for current round have partially been distributed
ThrusterTreasure runs an entropy-based lottery where users buy tickets per round and win prizes distributed by the owner. The entry gate in enterTickets() only verifies that the prize at index 0 has not yet been set, so once the owner sets prizes for any higher index while index 0 is still open, new tickets are still accepted. Those late tickets can only compete for the still-open index-0 prize and are thereby economically worth less than earlier tickets, letting users spend funds with no chance at the already-assigned prizes. The judge ultimately upheld the finding at Medium severity, noting it can be triggered by ordinary ordering (an owner prize-setting transaction landing before a user's entry) and that users lose money with no expected return.