Thruster — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Thruster, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 4
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 4 closed, publicly disclosed Thruster reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Thruster
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Thruster: Tickets can be entered after prizes for current round have partially been distributed
ThrusterTreasure runs an entropy-based lottery where users buy tickets per round and win prizes distributed by the owner. The entry gate in enterTickets() only verifies that the prize at index 0 has not yet been set, so once the owner sets prizes for any higher index while index 0 is still open, new tickets are still accepted. Those late tickets can only compete for the still-open index-0 prize and are thereby economically worth less than earlier tickets, letting users spend funds with no chance at the already-assigned prizes. The judge ultimately upheld the finding at Medium severity, noting it can be triggered by ordinary ordering (an owner prize-setting transaction landing before a user's entry) and that users lose money with no expected return.
Thruster: Incorrect gas claiming logic in `ThrusterPoolDeployer`
ThrusterPoolDeployer's claimGas() hard-codes address(0) as the contract whose Blast gas is claimed, instead of address(this). Because Blast.claimMaxGas requires the caller to be an authorized signer for the target contract, passing the zero address always reverts, so the deployer can never reclaim the gas rebates it generates on Blast. The sponsor confirmed the defect (a leftover from Blast's original docs that was missed in the commit freeze) and agreed to Medium severity since no user funds are affected. The fix is a one-line change passing address(this).
Thruster: Dynamic modification of `maxPrizeCount` affects prize claims
ThrusterTreasure is a round-based lottery contract where the owner-controlled maxPrizeCount caps the number of prize indices that can be claimed per round. Because claimPrizesForRound() iterates prize indices up to the current, mutable value of maxPrizeCount rather than the value that was in effect when a round was configured, an owner who lowers the limit after prizes are set but before they are claimed permanently bricks the claims of winners at higher prize indices. The same claim call clears the user's round entries, so restoring the value later cannot recover the lost prizes. The finding is a confirmed owner-triggered logic error that denies legitimate winners their winnings, with a proposed checkpoint-based fix and a simpler require-not-decrease alternative endorsed by the sponsor.
Thruster: `claimPrizesForRound` transfers the entire amount deposited for a prize regardless of the number of winners
ThrusterTreasure's claim path pays out the entire prize recorded by setPrize() to the first qualifying caller instead of splitting it across the configured winner count. Because _claimPrize unconditionally transfers the full stored WETH/USDB amounts, the first winner for a round/prize index drains the pool and locks out the other winners, whose claims then revert or pay nothing. The warden and sponsor agreed on the finding, and the proposed fix scales the amount pulled from the owner by the number of winners so each winner can be paid their share.