Wise Lending — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Wise Lending, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 21
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 21 closed, publicly disclosed Wise Lending reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Reentrancy, Oracle manipulation, Integer overflow / underflow, Front-running / MEV, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Wise Lending
- Reentrancy findings disclosed against Wise Lending
- Oracle manipulation findings disclosed against Wise Lending
- Integer overflow / underflow findings disclosed against Wise Lending
- Front-running / MEV findings disclosed against Wise Lending
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Wise Lending: `PendlePowerFarmToken:: totalLpAssetsToDistribute` may lead to temporary DOS due to price growth check being skipped during deposit
The PendlePowerFarmToken contract in the Wise Lending protocol is vulnerable to a denial-of-service (DOS) attack due to a flaw in its share price growth validation logic. An attacker can donate tokens to the vault through the `addCompoundRewards()` function, which triggers a validation check that causes subsequent legitimate operations like deposits and withdrawals to revert. This occurs because the share price is not updated atomically with the rewards donation, leaving the system in an inconsistent state that fails the security check for an extended duration. This allows any user to effectively lock the vault and prevent other users from accessing their positions.
Wise Lending: Exploitation of the receive Function to Steal Funds
The Wise Lending protocol was vulnerable to a reentrancy attack due to a flaw in its `_sendValue` helper function. An attacker could trigger a nested call during an ETH withdrawal that prematurely reset the protocol's reentrancy guard flag, `sendingProgress`. This allowed the attacker to execute arbitrary protocol functions—such as debt repayment—during a sensitive withdrawal window, enabling them to manipulate their account state and extract funds by bypassing health checks.
Wise Lending: Off-by-one bug prevents the `_compareMinMax()` from detecting Chainlink aggregators' circuit-breaking events
The Wise Lending protocol features an oracle validation mechanism, _compareMinMax, designed to prevent the use of Chainlink price feeds that have triggered circuit-breakers during extreme market volatility. A logic error in this function uses strict inequality operators for boundary checks, causing it to ignore instances where an oracle returns the exact minimum or maximum threshold values. This flaw allows the protocol to accept potentially stale or erroneous prices during flash crashes, which could be exploited by users to borrow assets against artificially inaccurate collateral values.
Wise Lending: Liquidating chaining can be achieved by liquidating token collateral with the highest `collateralFactor`
The Wise Lending protocol's liquidation mechanism exhibits a vulnerability where liquidators can chain multiple liquidation calls to drain more collateral than intended. Because the system allows liquidators to choose which collateral assets they receive during a liquidation, an attacker can strategically select tokens with the highest collateral factors to force the borrower's weighted collateral value to remain low. This allows the attacker to repeatedly perform partial liquidations that should have been limited by the protocol's constraints, ultimately allowing them to drain more collateral than permitted by the 50% restriction rule.
Wise Lending: Precision loss in the calculation of the fee amounts and fee shares inside the `_preparePool` function of the `MainHelper` contract
The Wise Lending protocol contained a precision loss vulnerability in its fee calculation logic within the `_updatePseudoTotalAmounts` function. By performing division before multiplication, the contract prematurely truncated intermediate values, causing the protocol to calculate and accrue less fee revenue than intended. This issue was particularly significant when calculating fees for `bareIncrease` amounts close to the precision factor, leading to a direct and continuous loss of expected protocol revenue.
Wise Lending: Exiting a farm on mainnet assumes a peg of `1:1` when swapping stETH for ETH
Wise Lending's Pendle power farm contracts contained a pricing logic flaw when exiting leveraged yield farming positions on Ethereum mainnet. When swapping redeemed stETH back into ETH via Curve, the protocol computed minimum acceptable swap outputs by querying WETH price feeds, effectively assuming a strict 1:1 peg between stETH and ETH. If stETH depegged from ETH, the protocol would demand a minimum ETH output that the Curve pool could not satisfy based on market rates. This caused all position exit transactions to systematically revert, temporarily trapping user collateral and preventing position liquidation or closure during volatile market conditions.
All reports in this group
- Wise Lending: A user can lose more value than he specifies in the spread when he enters a `PowerFarm`Logic error$0
- Wise Lending: Borrowers can DoS liquidations by repaying as little as 1 share.Front-running / MEV$0
- Wise Lending: Liquidators can pay less than required to completely liquidate the private collateral balance of an uncollateralized positionOracle manipulation$0
- Wise Lending: First depositor inflation attack in `PendlePowerFarmToken`Logic error$0
- Wise Lending: The protocol allows borrowing small positions that can create bad debtOracle manipulation$0
- Wise Lending: Unchecked return value bug on `TransferHelper::_safeTransferFrom()`Logic error$0
- Wise Lending: `PendlePowerManager` is incompatible with `PendleRouterV3`Oracle manipulation$0
- Wise Lending: Wrong use of `nftID` to check if a `PowerFarm` position is an Aave positionInteger overflow/underflow$0
- Wise Lending: User can erase their position debt for freeOracle manipulation$0
- Wise Lending: Incorrect calculation of lending shares in `_withdrawOrAllocateSharesLiquidation` can lead to revert and failure to liquidateLogic error$0
- Wise Lending: Incorrect bad debt accounting can lead to a state where the `claimFeesBeneficial` function is permanently bricked and no new incentives can be distributed, potentially locking pending and future protocol fees in the `FeeManager` contractOracle manipulation$0
- Wise Lending: Lack of update when modifying pool feeLogic error$0
- Wise Lending: User's attempt to deposit & withdraw reverts due to the calculation style inside `_calculateShares()`Logic error$0
- Wise Lending: Current heartbeat implementation may lead to a prolonged DoS for Chainlink OraclesOracle manipulation$0
- Wise Lending: Withdrawing uncollateralized deposits is possible even though the position is in liquidation modeLogic error$0