Wise Lending — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Wise Lending, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 20
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 20 closed, publicly disclosed Wise Lending reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Reentrancy, Integer overflow / underflow, Oracle manipulation, Logic error, Front-running / MEV, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Reentrancy findings disclosed against Wise Lending
- Integer overflow / underflow findings disclosed against Wise Lending
- Oracle manipulation findings disclosed against Wise Lending
- Logic error findings disclosed against Wise Lending
- Front-running / MEV findings disclosed against Wise Lending
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Wise Lending: Exploitation of the receive Function to Steal Funds
The Wise Lending protocol was vulnerable to a reentrancy attack due to a flaw in its `_sendValue` helper function. An attacker could trigger a nested call during an ETH withdrawal that prematurely reset the protocol's reentrancy guard flag, `sendingProgress`. This allowed the attacker to execute arbitrary protocol functions—such as debt repayment—during a sensitive withdrawal window, enabling them to manipulate their account state and extract funds by bypassing health checks.
Wise Lending: Wrong use of `nftID` to check if a `PowerFarm` position is an Aave position
The Wise Lending protocol suffers from a critical logic flaw where it inconsistently uses identifiers to verify the status of PowerFarm positions. The system incorrectly uses a WiseLending 'nftId' to query the 'isAave' mapping, which is designed to be indexed by a PowerFarm 'keyId'. This mismatch prevents the protocol from correctly identifying Aave-backed positions, causing failures in debt ratio calculations, loan repayments, and essential liquidation procedures. Consequently, malicious users can hold undercollateralized positions that cannot be liquidated by the protocol.
Wise Lending: User can erase their position debt for free
The Wise Lending protocol contains a critical logic error in its position management system. A cleanup function intended to remove position data fails to validate that a provided token actually exists in the user's position before removing it. An attacker can exploit this by triggering debt repayment functions with invalid tokens for a position with existing bad debt, causing the system to erroneously delete the borrower's debt records while retaining their collateral. This allows for the complete erasure of debt and potential theft of the underlying protocol assets.
Wise Lending: The protocol allows borrowing small positions that can create bad debt
The Wise Lending protocol allows users to open excessively small borrowing positions that are economically infeasible to liquidate. Because the protocol fails to enforce a minimum borrowing amount and lacks constraints on withdrawing collateral below a minimum threshold, users can manipulate their positions to remain in a perpetually 'underwater' state that is too small for liquidators to profitably close. This results in the accumulation of bad debt within the protocol, as the cost of liquidating these small positions exceeds any potential profit due to gas fees.
Wise Lending: Withdrawing uncollateralized deposits is possible even though the position is in liquidation mode
A logic inconsistency in Wise Lending allows users with liquidatable positions to withdraw uncollateralized deposits. When withdrawing from uncollateralized pools, WiseSecurity.checksWithdraw incorrectly sets powerFarmCheck to true, causing the protocol health check to evaluate solvency using bare collateral values instead of weighted collateral values. As a result, positions that are actively in liquidation mode under weighted collateral rules are allowed to complete withdrawals. This permits borrowers to extract uncollateralized assets rather than retaining them within the system to buffer impending liquidations.
Wise Lending: Exiting a farm on mainnet assumes a peg of `1:1` when swapping stETH for ETH
Wise Lending's Pendle power farm contracts contained a pricing logic flaw when exiting leveraged yield farming positions on Ethereum mainnet. When swapping redeemed stETH back into ETH via Curve, the protocol computed minimum acceptable swap outputs by querying WETH price feeds, effectively assuming a strict 1:1 peg between stETH and ETH. If stETH depegged from ETH, the protocol would demand a minimum ETH output that the Curve pool could not satisfy based on market rates. This caused all position exit transactions to systematically revert, temporarily trapping user collateral and preventing position liquidation or closure during volatile market conditions.
All reports in this group
- Wise Lending: First depositor inflation attack in `PendlePowerFarmToken`Logic error$0
- Wise Lending: Liquidators can pay less than required to completely liquidate the private collateral balance of an uncollateralized positionOracle manipulation$0
- Wise Lending: Incorrect bad debt accounting can lead to a state where the `claimFeesBeneficial` function is permanently bricked and no new incentives can be distributed, potentially locking pending and future protocol fees in the `FeeManager` contractOracle manipulation$0
- Wise Lending: Precision loss in the calculation of the fee amounts and fee shares inside the `_preparePool` function of the `MainHelper` contractInteger overflow/underflow$0
- Wise Lending: `PendlePowerFarmToken:: totalLpAssetsToDistribute` may lead to temporary DOS due to price growth check being skipped during depositLogic error$0
- Wise Lending: A user can lose more value than he specifies in the spread when he enters a `PowerFarm`Logic error$0
- Wise Lending: Unchecked return value bug on `TransferHelper::_safeTransferFrom()`Logic error$0
- Wise Lending: Liquidating chaining can be achieved by liquidating token collateral with the highest `collateralFactor`Oracle manipulation$0
- Wise Lending: User's attempt to deposit & withdraw reverts due to the calculation style inside `_calculateShares()`Logic error$0
- Wise Lending: Current heartbeat implementation may lead to a prolonged DoS for Chainlink OraclesOracle manipulation$0
- Wise Lending: Borrowers can DoS liquidations by repaying as little as 1 share.Front-running / MEV$0
- Wise Lending: Off-by-one bug prevents the `_compareMinMax()` from detecting Chainlink aggregators' circuit-breaking eventsOracle manipulation$0
- Wise Lending: Lack of update when modifying pool feeLogic error$0
- Wise Lending: `PendlePowerManager` is incompatible with `PendleRouterV3`Oracle manipulation$0