Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOM
HackerOneMonero2026-10-28
Web3
High
BUG BOUNTY WRITEUPS
Web3 writeups
Smart contract, wallet and blockchain-related security reports.
44 reports and writeups from 2024 to 2026. 33 carry a severity from the disclosing platform, 12 of them rated High or Critical. Last updated 2026-10-30.
Latest Web3 reports
Search and filter all writeupsRestricted ZMQ RPC bypasses HTTP restricted-mode resource checks
HackerOneMonero2026-09-17
Web3
Medium
ZMQ get_output_distribution duplicate amount DoS
HackerOneMonero2026-09-17
Web3
Medium
sign_multisig crashes monero-wallet-rpc on a malformed but decryptable multisig txset
HackerOneMonero2026-09-17
Web3
High
Authenticated `unsigned_txset` change spoof lets a malicious hot wallet steal cold-signer change
HackerOneMonero2026-09-16
Web3
High
Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution
HackerOneMonero2026-08-20
Web3, Windows
High
Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field
HackerOneMonero2026-08-20
Web3
Medium
HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer
HackerOneMonero2026-08-20
Web3
Medium
View-only offline transaction creation bypasses the long-payment-ID privacy block
HackerOneMonero2026-08-20
Web3
Medium
monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction mode
HackerOneMonero2026-08-20
Android, Web3
Medium
Loss of multisig funds through single malicious participant's deliberate deception
HackerOneMonero2026-08-20
Web3
Medium
Background sync cache retains outgoing additional transaction secret keys
HackerOneMonero2026-08-20
Web3
Low
Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin Actions
HackerOneMonero2026-08-17
Web3
High
Wallet RPC Restricted-Mode Policy Bypass
HackerOneMonero2026-08-17
Web3
High
`check_reserve_proof` sums RingCT ECDH amounts without checking the output commitment
HackerOneMonero2026-08-05
Web3
Medium
`check_reserve_proof` counts duplicate entries: one output can inflate `total`
HackerOneMonero2026-08-05
Web3
Medium
wallet-rpc describe_transfer uses real_output_in_tx_index instead of real_output: cold-wallet pre-sign review shows wrong ring member
HackerOneMonero2026-08-05
Web3
Medium
`set_daemon` wallet-rpc silently ignores `ssl_allowed_fingerprints` → pinning bypassed, wallet↔daemon MITM
HackerOneMonero2026-08-05
Web3
High
SpendProofV1 txid-substitution: get_spend_proof/check_spend_proof do not verify returned transaction hash
HackerOneMonero2026-08-05
Web3
Medium
wallet-rpc crash via malformed /gettransactions response (empty txs → vector::front() in check_tx_key / check_tx_proof)
HackerOneMonero2026-08-05
Web3
High
`relay_tx` wallet-rpc skips `--restricted-rpc` guard and lets any caller corrupt wallet state via attacker-controlled `pending_tx`
HackerOneMonero2026-08-05
Web3
Low
ZMQ RPC Log Injection and Untrusted Payload Persistence
HackerOneMonero2026-07-24
Web3
Medium
Restricted RPC leaks alternative block hashes via /get_alt_blocks_hashes
HackerOneMonero2026-07-20
Web3
Low
Remote node DOS
HackerOneMonero2026-06-29
Web3
Medium
Inverted ternary in peerlist_manager::filter() allows unlimited whitelist entries per host via different ports
HackerOneMonero2026-06-29
Web3
Not rated
POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)
HackerOneCoinMate.io2026-05-20
API, Web3
Medium
Critical Deadlock Vulnerability in Monero RPC Leading to Complete Node Paralysis
HackerOneMonero2026-05-06
Web3
Critical
Connection Count Bug in Monero Node Enables Outbound Peer Reset Attack
HackerOneMonero2026-05-06
Web3
Not rated
Reported RPC Overflow
HackerOneMonero2026-04-06
Web3
Not rated
Reported Denial of Service
HackerOneMonero2026-04-06
Web3
Not rated
Crafted smart contract can take 8 minutes to execute due to bug in modexp precompile.
HackerOneRootstock Labs2025-06-13
Web3
High
Crafted smart contract can take 1.5 minutes to execute due to inefficient CODESIZE implementation
HackerOneRootstock Labs2025-06-12
Web3
Medium
Crafted smart contract can take ~23 seconds to execute due to immense error string construction
HackerOneRootstock Labs2025-06-12
Web3
Medium
Dynamic fee algorithm doesn't check for zero fee
HackerOneMonero2025-05-23
Web3
Low
RPC service DOS
HackerOneMonero2025-05-23
Web3
Medium
Spamming highly nested JSON RPC requests cause node to disconnect from p2p network
HackerOneMonero2025-04-23
Web3
Not rated
Remote memory exhaustion in Epee RPC stack under zero Receive Window
HackerOneMonero2025-04-23
Web3
High
A peer can remotely fill the pending block queue to an extremely high size, with blocks that will never leave the queue.
HackerOneMonero2025-04-23
Web3
Not rated
Transactions in invalid blocks are kept in tx-pool without undergoing certain checks.
HackerOneMonero2025-04-23
Web3
Not rated
low-level p2p ping + tcp flooding leads to a remote crash in monerod
HackerOneMonero2025-04-14
Web3
Critical
[Monero wallet RPC] File precreation to file ownership and credentials leak
HackerOneMonero2024-09-04
Web3
Not rated
Supply Chain Attacks: A New Era
Researcher blogLavamoat2024-06-10
Web3, Source Code
Not rated
The Fast and the Curious: Finding a Race Condition in Worldcoin
MediumTools for Humanity (Worldcoin)2024-04-08$3,000 bounty
Web3
Not rated
Web3’s Achilles’ Heel: A Supply Chain Attack on Astar Network
Researcher blogAstar Network2024-01-19
Web3, Source Code
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.