Union Finance — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Union Finance, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 12
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 12 closed, publicly disclosed Union Finance reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Union Finance
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Union Finance: `UnionToken` should check whitelist on `from`?
Union Finance's UnionToken enforces its whitelist guest list inside the OpenZeppelin ERC20 _beforeTokenTransfer hook, but validates isWhitelisted(msg.sender) rather than isWhitelisted(from). Because the hook fires on both transfer and transferFrom, a single whitelisted contract or relayer can be granted an allowance and move tokens out of any non-whitelisted account as long as the operator itself passes the whitelist. This effectively sidesteps the guest list entirely for any token holder who establishes an allowance. The sponsor confirmed the issue and the judge upheld it as medium severity, directing that the check be applied to the from address.
Union Finance: Rebalance will fail due to low precision of percentages
Union Finance's AssetManager.rebalance ends with a strict require that the contract holds zero token balance after re-depositing withdrawn liquidity. Allocation percentages are encoded in basis points (1 = 0.01%) while the ERC20 tokens carry much higher precision, so the proportional split almost always leaves a sub-unit dust remainder. Unless the last market both supports the token and absorbs the leftover, the final zero-balance check reverts the entire rebalance. The Union team confirmed the finding and agreed to either drop the check or route remaining tokens to the final funded market.
Union Finance: `MAX_TRUST_LIMIT` might be too high
Union Finance computes staker credit limits and locked amounts by sorting the set of trusted stakers inside SumOfTrust.sol and CreditLimitByMedian.sol, invoked through UserManager's getLockedAmount and getCreditLimit. The staker set per user is only bounded by MAX_TRUST_LIMIT, which sits at 100. Because the sort is O(n log n) with high gas cost, a trust list approaching that bound can exhaust the block gas limit and cause the lookup transactions to revert. An attacker who can vote in enough accounts (and induce others to stake) can grow a victim's trust list into that range, turning the cost into a griefing denial of service. The protocol team acknowledged they had tested the 100-entry threshold and intentionally kept it, while the judge agreed the finding is a valid but conditional, low-likelihood griefing issue.
Union Finance: Change in interest rate can disable repay of loan
Union Finance's fixed-rate lending market lets the FixedInterestRateModel owner configure a borrow rate with no upper-bound validation, while UToken::borrowRatePerBlock() reverts when the rate is considered excessively high. Because repayment accrues interest through that rate check first, a borrower's repay transaction fails whenever such a rate is set, effectively locking the loan. The warden judged this could be used adversarially by the owner, who could briefly disable repayments and later restore a higher demanded interest. The judge confirmed the finding as medium severity, agreeing a setter-side bound is the correct fix.
Union Finance: Comptroller rewards can be artificially inflated and drained by manipulating [totalStaked - totalFrozen] (or: wrong rewards calculation)
Union Finance's Comptroller rewards system computed a user's effective staked amount as (totalStaked - totalFrozen), a value an attacker can shrink nearly to zero by staking a tiny additional amount that is never approved for anyone's loan. This tiny effectiveAmount enters the inflation-index calculation, where dividing by it and reading the inflationPerBlock lookup at its maximum value massively inflates curInflationIndex (215 WAD vs a 1 WAD baseline in the PoC). A staker can then withdraw a disproportionate share of the reward pool — 873 of 1000 seeded UNION tokens in the demonstrated scenario — effectively draining the contract, with the magnitude scaling as the anchor stake is shrunk.
Union Finance: debtWriteOff updates `totalFrozen` immaturely, thereby losing staker rewards
Union Finance's UserManager.debtWriteOff updates totalFrozen before calling comptroller.withdrawRewards within the same transaction. For a staker whose borrowers are overdue, this raises totalFrozen to equal totalStaked, and the reward formula totalStaked - totalFrozen then evaluates to zero, so the staker receives no unionToken staking rewards despite being entitled to them. The report contrasts this with stake, unstake, and withdrawRewards, which all credit rewards before mutating the frozen state, and proposes moving the withdrawal ahead of the frozen-state update. The sponsor acknowledged the finding and the judge upheld a Medium severity rating on the basis that it is a loss of yield.
All reports in this group
- Union Finance: Duplicate `utoken` and `usermanager` can be added which cannot be deletedLogic error$0
- Union Finance: User Fund loss in case of Unsupported Market token depositLogic error$0
- Union Finance: `borrow` must `accrueInterest` firstLogic error$0
- Union Finance: Wrong implementation of `CreditLimitByMedian.sol#getLockedAmount()` will lock a much bigger total amount of staked tokens than expectedLogic error$0
- Union Finance: Wrong implementation of `CreditLimitByMedian.sol#getLockedAmount()` makes it unable to unlock `lockedAmount` in `CreditLimitByMedian` modelLogic error$0
- Union Finance: Rebalance will fail if a market has high utilizationLogic error$0