Ubiquity — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Ubiquity, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Ubiquity reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Oracle manipulation, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Oracle manipulation findings disclosed against Ubiquity
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Ubiquity: LibUbiquityPool::mintDollar/redeemDollar reliance on outdated TWAP oracle may be inefficient for preventing depeg
Ubiquity's dollar pool gates uAD minting and burning on a TWAP oracle sourced from a Curve metapool. The protocol refreshes its own TWAP snapshot via LibTWAPOracle.update but never invokes the underlying metapool's internal update, so the cumulative balances consulted can be stale even when the staleness check passes. This means mints and redeems can be permitted or blocked based on an outdated pool state, allowing actors to enter or exit outside the intended 0.99-1.01 pegging thresholds. Because uAD is treated as $1 while the collateral Chainlink feed sets the exchange rate, a discrepancy between the TWAP and Chainlink can let a holder redeem uAD for collateral on terms that no longer reflect the true uAD price, weakening the protocol's verifiable-solvency guarantee. The judge ultimately upheld the finding as Medium severity, agreeing with the deduplication that only a subset of reports identified the true root cause in the metapool updating mechanism.
Ubiquity: LibTWAPOracle::update Providing large liquidity will manipulate TWAP, DOSing redeem of uADs
Ubiquity's LibTWAPOracle derives its price feed from Curve's time-weighted average of pool balances rather than a true time-weighted price. Because imbalance is weighted by duration rather than by the actual spot ratio, an actor with large capital who controls two consecutive blocks can deposit heavily imbalanced liquidity, withdraw it the next block, and leave the oracle skewed across many subsequent blocks — DoSing uAD redemptions in UbiquityPool for up to hours. The finding was adjudicated as Medium (the escalation to Low was rejected), with duplicates, and the protocol shipped a fix in PR #893 that the Lead Senior Watson signed off.