highLogic errorMove
BMX Deli Swap: Finalize-window vote-changing vulnerability: auto-voters can alter choices post-epoch to manipulate results
- Payout
- $0
- Protocol
- BMX Deli Swap
- Disclosed
- Sep 16, 2025
- Source
- sherlock
BMX Deli Swap's Voter contract fails to freeze or snapshot auto-vote choices when an epoch ends, so auto-voters remain able to enable, switch, or re-weight their vote after the epoch is closed but before the admin runs the batched finalize. Because _tallyAutoV …
Similar reports
- No close matches yet.
References
This report is already public and closed. CoinBuggie never publishes active or unpatched vulnerability data.