Zivoe — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Zivoe, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 22
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 22 closed, publicly disclosed Zivoe reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Oracle manipulation, Flash loan attack, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Zivoe
- Oracle manipulation findings disclosed against Zivoe
- Flash loan attack findings disclosed against Zivoe
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Zivoe: EMA Data Point From Unlock Is Discarded
Zivoe's yield-distribution vault weights its EMA computation of STT/JTT supplies by a counter that is incremented to one before the first post-unlock call. Because the MATH.ema helper degenerates to returning only the latest data point when N equals 1, the supply snapshot captured at unlock time is dropped from the EMA series, skewing every subsequent yield distribution between the two token classes. The sponsor confirmed the unintended N=1 baseline and merged a fix, which the Lead Senior Watson signed off on.
Zivoe: Protocol unable to get extra Rewards in OCY_Convex_C
Zivoe's OCY_Convex_C locker fetches Convex extra rewards for pool 270 but reads and transfers them using the wrong token address. For Convex pools with IDs 151+, the extra reward token is a StashTokenWrapper, whereas getReward() unwraps it and returns the underlying token, so the wrapper balance always reads zero and extra rewards silently accumulate without ever being forwarded to the OCT_YDL. The bug is a passive accounting failure rather than an active exploit, yet it persistently costs users additional convex yield across each 30-day cycle. The finding was adjudicated High with duplicates and fixed by calling rewardToken().token() for both the balanceOf and safeTransfer operations.
Zivoe: ZivoeYDL::distributeYield() will revert if protocolRecipients recipients length is smaller than residualRecipients
Zivoe's ZivoeYDL yield-distribution contract contains an array-index bug that can permanently brick the core distributeYield() function. earningsTrancheuse() sizes the internal _protocol[] and _residual[] arrays independently based on the separate lengths of protocolRecipients and residualRecipients, and the residual-distribution loop reads _protocol[i] (instead of _residual[i]) when emitting the YieldDistributedSingle event. Whenever residualRecipients is longer than protocolRecipients and at least one residual recipient is the stSTT or stJTT reward contract, the loop dereferences an out-of-bounds index and the transaction always reverts, making the protocol's primary yield payout unreachable through normal operational use. The protocol team fixed the off-by-array emit in a merged PR, and the lead senior Watson signed off on the remedy.
Zivoe: distributeYield() calls earningsTrancheuse() with outdated emaSTT & emaJTT while calculating senior & junior tranche yield distributions
Zivoe's distributeYield() computes the senior and junior tranche split by calling earningsTrancheuse() before it refreshes the EMA supply values (emaSTT/emaJTT), so the yield-target and tranche-proportion math runs on stale EMA data from the prior distribution period. Because the EMA smooths tranche-token supply over roughly 2.5 months and directly drives yieldTarget(), seniorProportion(), and juniorProportion(), any material supply shift between distributions — such as junior-tranche shrinkage from defaulted loans or growth from new deposits — makes the protocol over- or under-pay each tranche relative to its fair share. The fix reorders the code to update the EMA values before the earningsTrancheuse() call; the sponsor applied it in PR 263 and the Lead Senior Watson signed off. The final adjudicated severity after judging debate was Medium.
Zivoe: Title: Inadequate Allowance Handling in convertAndForward Function of `OCT_DAO` & `OCT_YDL`.
Zivoe's OCT_DAO and OCT_YDL locker contracts run a convertAndForward flow that sets a token allowance for the 1inch v5 router, performs the conversion, and then asserts the allowance returned to zero. Because the allowance is never explicitly reset, any swap in which the router leaves a nonzero residual allowance forces the assertion to fail and the entire transaction to revert, permanently blocking valid conversions and burning caller gas. The finding was ruled valid by the lead judge and fixed in Zivoe PR 262, with the fix signed off by the Lead Senior Watson, although judges noted the warden never supplied a concrete proof-of-concept of a successful swap leaving residual allowance.
Zivoe: OCC_Modular::applyCombine will round APR down
Zivoe's OCC_Modular.applyCombine merges multiple loans into a single one by computing the new APR as a weighted average that is written back into a BIP-denominated integer. Because the final division rounds toward zero, the combined APR can be underestimated by up to one basis point, and because the rounding loss is borne by the lending protocol rather than the borrower, an intentional combine can shave interest off a loan. The finding was escalated and validated as Medium severity after the lead judge confirmed the borrower can deliberately trigger the rounding by making a small repayment before executing the combination. The proposed fix is a divisibility check that rejects combined APRs which would lose precision.
All reports in this group
- Zivoe: OCL_ZVE.sol::forwardYield relies on manipulable Uniswap V2 pool reserves leading to theft of fundsOracle manipulation$0
- Zivoe: Forwarding yield in `OCL_ZVE` is possible a lot more often than the enforced 30 daysLogic error$0
- Zivoe: ITO can be manipulatedLogic error$0
- Zivoe: Anyone could call `depositReward` with zero reward to extend the period finish timeLogic error$0
- Zivoe: cannot forward extra rewards from both OCY_Convex to OCT_YDL.Logic error$0
- Zivoe: Time calculation issues with exponential decayLogic error$0
- Zivoe: ````depositReward()```` with zero amount to get reward tokens stuck in ````ZivoeRewards```` contractsLogic error$0
- Zivoe: User cannot withdraw stakingToken due to incorrect calculation of _totalSupplyLogic error$0
- Zivoe: Revoking vesting schedule does not subtract user votes correctlyLogic error$0
- Zivoe: When APR late rate is lower than APR, an OCC locker bullet loan borrower can pay way less interests by calling the loanLogic error$0
- Zivoe: `ZivoeTranches#rewardZVEJuniorDeposit` function miscalculates the reward when the ratio traverses lower/upper bound.Logic error$0
- Zivoe: `ZivoeYDL::earningsTrancheuse()` always assumes that `daysBetweenDistributions` have passed, which might not be the caseLogic error$0
- Zivoe: OCL_ZVE::pushToLockerMulti() will revert due to incorrect assert() statements when interacting with UniswapV2Logic error$0
- Zivoe: Rewards are calculated as distributed even if there are no stakers, locking the rewards foreverLogic error$0
- Zivoe: DAO unable to withdraw their funds due to Convex admin actionLogic error$0
- Zivoe: ZivoeYDL::distributeYield yield distribution is flash-loan manipulatableFlash loan attack$0