Zivoe — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Zivoe, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Zivoe reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Zivoe
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Zivoe: ````depositReward()```` with zero amount to get reward tokens stuck in ````ZivoeRewards```` contracts
ZivoeRewards.depositReward() is callable by anyone because it carries no access control, and each zero-amount call forces the rewardRate to be recomputed via integer division against the full rewardsDuration. That division truncates the rate, and because a fresh call extends the period finish and recomputes from the leftover dust, each trivial call strands a slice of the deposited reward balance in the contract indefinitely. Repeated zero-amount calls thus accumulate dust that can be substantial for low-decimal tokens; the PoC strands 654 of 1,000 USDC and 6.6 of 10 WBTC after only 20 such calls. Sherlock's judge rated the finding high, and the fix (raising rewardRate precision and/or whitelisting callers) was merged and signed off.
Zivoe: User cannot withdraw stakingToken due to incorrect calculation of _totalSupply
Zivoe's vesting rewards contract miscalculated the global _totalSupply during revokeVestingSchedule by subtracting the full original vesting amount rather than the amount withdrawn. When a user with an active vesting schedule withdraws part of their tokens and then has their schedule revoked, totalSupply falls below the sum still claimable by other users. A subsequent user's withdraw then underflows and reverts, permanently blocking them from claiming their stakingToken rewards. The issue was confirmed as high severity by the sponsor and fixed in a follow-up PR.