TITLES Publishing Protocol — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for TITLES Publishing Protocol, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 7
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 7 closed, publicly disclosed TITLES Publishing Protocol reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Access control, Reentrancy, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against TITLES Publishing Protocol
- Access control findings disclosed against TITLES Publishing Protocol
- Reentrancy findings disclosed against TITLES Publishing Protocol
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
TITLES Publishing Protocol: New creators unable to update the royalty target and the fee route for their works
In TITLES Publishing Protocol, the transferWork function changes which address is recorded as a work's creator but leaves the royalty target and fee route pointing at the previous creator. Because only the restricted EDITION_MANAGER_ROLE can update the royalty target and only Owner/Admin can update the fee route, a new creator who acquires a work cannot redirect revenue streams to themselves. As a result, royalties and fees keep being paid to the prior creator, causing a loss of expected assets for the new owner. The finding was confirmed as Medium after an escalation argued it was merely unintuitive intended behavior; the team subsequently shipped a fix allowing creators to update these settings.
TITLES Publishing Protocol: Broken batch minting feature
The TITLES protocol's batch minting function is broken because it forwards the entire msg.value payment to the fee manager on every loop iteration. Since msg.value is not decremented per token, the first iteration routes the full ETH amount to the fee manager leaving the Edition contract with zero balance, causing the second and subsequent collectMintFee calls to revert with insufficient funds. This makes the batch mint feature unusable for any request with more than one token, a core protocol capability. The fix is to forward only the per-token mint fee rather than the full msg.value on each iteration, and the maintainers signed off on this correction.
TITLES Publishing Protocol: TitlesGraph::acknowledgeEdge() methods do not write acknowledgments to storage
TitlesGraph's acknowledgeEdge flow is broken because _setAcknowledged returns an Edge declared as memory rather than storage. The function reads edges[edgeId_] into a local memory copy, sets the acknowledged flag on that copy, and emits the acknowledgment event — but the write never reaches persistent state. As a result, edges can never be acknowledged; the flag remains false after a successful transaction. The fix, confirmed by the protocol and signed off by the Lead Senior Watson, is a one-line change from Edge memory to Edge storage.
TITLES Publishing Protocol: Malicious users can block creators from acknowledging or deacknowledging an edge
TITLES' TitlesGraph lets an edge's creator acknowledge or unacknowledge an edge via signed calls. Both acknowledgeEdge and unacknowledgeEdge use the same checkSignature modifier and the same ACK_TYPEHASH, so a signature produced for one action is structurally valid for the other, and the shared _isUsed mapping marks it spent. A malicious observer can front-run a creator's acknowledgeEdge transaction, submit the intercepted signature to unacknowledgeEdge instead, and burn it so the intended call reverts. Because gas on L2 is cheap, an attacker can repeatedly grief a target, blocking them from setting or clearing acknowledgement and corrupting the graph's attribution data — which the contest explicitly scoped as a valid medium finding distinct from fund loss.
TITLES Publishing Protocol: Incorrect encoding of bytes for EIP712 digest in `TitleGraph` causes signatures generated by common EIP712 tools to be unusable
The TITLES publishing protocol's TitleGraph contract validates EIP712 signatures in the checkSignature() modifier used by acknowledgeEdge() and unacknowledgeEdge(). The digest is reconstructed by encoding the `data` bytes argument directly with abi.encode, but per EIP712 the dynamic `bytes` value must first be hashed with keccak256. Because the contract hashes raw bytes while common tools like ethers.js signTypedData hash the bytes content first, signatures produced with standard EIP712 libraries will always fail validation, making the acknowledge/unacknowledge functions unusable for off-chain-signed workflows. The report includes a reproducible two-way PoC comparing ethers.js and foundry signatures, and the fix (adding keccak256(data) to the digest computation) was applied and signed off by the Lead Senior Watson.
TITLES Publishing Protocol: Users can exploit the batch minting feature to avoid paying minting fees for tokens
In TITLES' Edition.sol, the batch minting function charges the mint fee only for a single `amount_` rather than for the total number of tokens actually minted across all receivers. By passing the same address repeatedly in `receivers_` with a small `amount_`, a minter receives a large number of tokens while paying the fee for only one. This underpayment directly reduces the fees owed to the creator and fee recipients, and the protocol team acknowledged and fixed the issue by charging based on `amount_ * receivers_.length`.