Usual V1 — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Usual V1, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Usual V1 reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Usual V1
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Usual V1: A missing reward update in UsualSP::removeOriginalAllocation will cause reduced reward accumulation for users
Usual's staking contract UsualSP exposes a bug in the `removeOriginalAllocation` function: when an operator removes a recipient's original token allocation, the contract directly zeroes `originalAllocation` (and `originalClaimed`) in storage without first calling the reward accrual hook. Because `balanceOf` is computed from `originalAllocation - originalClaimed`, and `_earned` derives accrued rewards from `balanceOf`, the zeroed allocation makes the recipient's subsequent `claimReward` reference a reduced balance, permanently shorting them rewards accumulated during the active accrual period. The finding was validated as a high-severity H-1 by the Sherlock platform and fixed by the protocol via adding `_updateReward(recipients[i])` before the reset.
Usual V1: Withdrawal fee for UsualX vault will be mis-calculated.
UsualX is an ERC-4626 yield vault in the Usual V1 pegasus codebase. Its withdraw() and previewWithdraw() functions disagree on how the withdrawal fee is computed: withdraw() divides the fee by BASIS_POINT_BASE while previewWithdraw(), which determines the shares actually burned, divides by BASIS_POINT_BASE minus the fee basis points. Because the assets argument in both functions is the pre-fee amount, the withdraw() fee is always smaller than the preview fee whenever the fee is positive. The shortfall is reflected in a totalDeposits decrement that is too small, inflating the redeemable value of all remaining depositors and letting later withdrawers extract more than their fair share at the protocol's expense. The protocol team confirmed the fix in pull request usual-dao/pegasus#1760.