Union Finance Update #2 — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Union Finance Update #2, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 3
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 3 closed, publicly disclosed Union Finance Update #2 reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Reentrancy, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Union Finance Update #2
- Reentrancy findings disclosed against Union Finance Update #2
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Union Finance Update #2: Minimum borrow amount can be surpassed and borrower can be treated as being overdue earlier than their actual overdue time
Union Finance's UToken.borrow() validates the minimum borrow amount against the requested value before it actually withdraws funds from the asset manager, and then only subtracts whatever the withdrawal returns from the effective amount. When the underlying asset manager markets have temporary liquidity shortages and can return only dust or zero, borrow() still succeeds with an effective amount below _minBorrow. Because the lastRepay timestamp is set on any borrow call, including a zero-amount one, a borrower who has fully repaid can be prematurely marked as overdue by a subsequent dust borrow, blocking them from borrowing/vouching and reducing lender staking rewards. The fix re-checks the effective amount after withdrawal.
Union Finance Update #2: Possible loss of funds, transfer functions can silently fail
Union Finance's VouchFaucet and ERC1155Voucher utilities call IERC20.transfer() without checking the boolean return value, on a protocol whose readme explicitly names USDT, USDC and DAI as supported tokens deployable on any EVM network including Ethereum mainnet. Because USDT's transfer() does not return the standard boolean, wrapper contracts that unwrap the return value revert, making claimTokens() and transferERC20() unusable with USDT, and any token that silently returns false on failure would be treated as a successful transfer. The Sherlock judge initially marked the finding QA, but after an escalation citing the readme's explicit USDT support, it was upheld as Medium with duplicates (#11, #17, #57, #116). The recommended fix is switching to OpenZeppelin's safeTransfer().
Union Finance Update #2: Any user can claim an unlimited amount of vouch in `VouchFaucet.sol`
The VouchFaucet.sol contract exposes a public `claimVouch()` function with no access control or rate limiting. Any address can call it to grant themselves `TRUST_AMOUNT` of trust on behalf of the contract, and by interleaving borrows with repeated calls, a user can bypass the intended per-user trust cap and drain the contract's entire staked lending capacity. The finding was escalated after an initial 'intended design' closure, and the judge validated it as a unique Medium-severity issue after confirming VouchFaucet must be a member for the protocol to function.