1️⃣ The vulnerability could cause an inconsistency between the actual balance and the balance state variable by calling the withdraw_admin_fees inside the fallback of remove_liquidity_imbalance. (reentrancy)
1
0
38
Replies
🐞I reported a vulnerability in
@CurveFinance
and I am thrilled to share that I've been awarded a bug bounty of $250,000. 🧵
42
68
1K
2️⃣ I submitted a report with a written PoC and they swiftly acknowledged my findings. I engaged in a fruitful exchange of emails, discussing the potential impact and possible mitigations directly with
@newmichwill
.
1
0
33
3️⃣ After thorough evaluation, the
@CurveFinance
team recognized the severity of the vulnerability and awarded me the maximum bug bounty of $250,000! Their professionalism and generosity were truly commendable.
1
0
81
4️⃣ I want to express my sincere gratitude to the amazing team at
@CurveFinance
, especially
@newmichwill
, for their prompt response and collaborative approach throughout the process. It was a pleasure to work with them.
1
0
48
5️⃣ To shed light on this fascinating journey, I've written an in-depth article that dives into the nitty-gritty details of the vulnerability. Don't miss it!
3
4
72
6️⃣ I'm a lead security researcher at
@KupiaSecurity
. Follow me for more updates on my cybersecurity explorations and future bug bounty endeavors.
1
0
46