Business logic vulnerabilities in disclosed bug bounty reports

Logic errors are the residual category and the hardest to find with tooling, because there is no unsafe pattern to grep for. The contract compiles, the tests pass, and the specification itself has a hole in it: an off-by-one in a reward epoch, a state machine that permits a transition nobody considered, an accounting path that credits twice under a specific ordering.

The reports gathered here are the strongest argument for reading disclosures rather than checklists. Each one is a case where a reviewer reconstructed the intended invariant, then found the input that violated it — and the write-ups usually show that reasoning explicitly.

Common shapes include edge cases at zero and at maximum, first and last participant conditions, and paths that behave differently when a step is skipped or repeated.