Search results

[Medium] Consensus pubkey squatting — PoP is not bound to operator/stakePool/chain, any pool operator can replay a victim's (pubkey, pop) to DoS their registration

bugSomething isn't workingSomething isn't working

coacker:pendingCoacker pipeline labelCoacker pipeline label

repo: contractsIssue in on-chain contractsIssue in on-chain contracts

severity: mediumDefense-in-depth concern, plan to fixDefense-in-depth concern, plan to fix

Status: Open.

#580 In Galxe/gravity-audit;

· keanji-x opened on Apr 18, 2026

[Medium] Unbounded setPatches + O(I²+P·I) regeneration per rotation can permanently stall JWK updates

bugSomething isn't workingSomething isn't working

coacker:pendingCoacker pipeline labelCoacker pipeline label

repo: contractsIssue in on-chain contractsIssue in on-chain contracts

severity: mediumDefense-in-depth concern, plan to fixDefense-in-depth concern, plan to fix

Status: Open.

#579 In Galxe/gravity-audit;

· keanji-x opened on Apr 18, 2026

[Medium] Governance-settable unbondingDelayMicros lacks upper bound — oversize value silently stalls withdrawals without reverting (no user-visible error)

bugSomething isn't workingSomething isn't working

coacker:pendingCoacker pipeline labelCoacker pipeline label

repo: contractsIssue in on-chain contractsIssue in on-chain contracts

severity: mediumDefense-in-depth concern, plan to fixDefense-in-depth concern, plan to fix

Status: Open.

#578 In Galxe/gravity-audit;

· keanji-x opened on Apr 18, 2026

[Medium] Governance-settable minimumStake lacks upper bound — value of type(uint256).max permanently bricks Staking.createPool

bugSomething isn't workingSomething isn't working

coacker:pendingCoacker pipeline labelCoacker pipeline label

repo: contractsIssue in on-chain contractsIssue in on-chain contracts

severity: mediumDefense-in-depth concern, plan to fixDefense-in-depth concern, plan to fix

Status: Open.

#577 In Galxe/gravity-audit;

· keanji-x opened on Apr 18, 2026

[Medium] StakingConfig setters take effect immediately with no pending/apply-at-epoch pattern — governance mutations observed mid-epoch by _renewActiveValidatorLockups

bugSomething isn't workingSomething isn't working

coacker:pendingCoacker pipeline labelCoacker pipeline label

repo: contractsIssue in on-chain contractsIssue in on-chain contracts

severity: mediumDefense-in-depth concern, plan to fixDefense-in-depth concern, plan to fix

Status: Open.

#576 In Galxe/gravity-audit;

· keanji-x opened on Apr 18, 2026

[High] Governance-settable lockupDurationMicros lacks upper bound — oversize value overflows now_+lockup in systemRenewLockup, halting epoch cascade across every active validator

bugSomething isn't workingSomething isn't working

coacker:pendingCoacker pipeline labelCoacker pipeline label

repo: contractsIssue in on-chain contractsIssue in on-chain contracts

severity: highExploitable security issueExploitable security issue

Status: Open.

#575 In Galxe/gravity-audit;

· keanji-x opened on Apr 18, 2026

[Medium] No grace period for newly-activated validators — first-epoch zero-proposal eviction under default autoEvictThreshold=0

bugSomething isn't workingSomething isn't working

coacker:pendingCoacker pipeline labelCoacker pipeline label

repo: contractsIssue in on-chain contractsIssue in on-chain contracts

severity: mediumDefense-in-depth concern, plan to fixDefense-in-depth concern, plan to fix

Status: Open.

#574 In Galxe/gravity-audit;

· keanji-x opened on Apr 18, 2026

[Medium] requiredProposerStake is a one-shot creation check — proposer can unstake immediately after, defeating spam-prevention economics

bugSomething isn't workingSomething isn't working

coacker:pendingCoacker pipeline labelCoacker pipeline label

repo: contractsIssue in on-chain contractsIssue in on-chain contracts

severity: mediumDefense-in-depth concern, plan to fixDefense-in-depth concern, plan to fix

Status: Open.

#573 In Galxe/gravity-audit;

· keanji-x opened on Apr 18, 2026

[Medium] Voter rotation via StakePool.setVoter during active proposal transfers remaining vote budget to new voter

bugSomething isn't workingSomething isn't working

coacker:pendingCoacker pipeline labelCoacker pipeline label

repo: contractsIssue in on-chain contractsIssue in on-chain contracts

severity: mediumDefense-in-depth concern, plan to fixDefense-in-depth concern, plan to fix

Status: Open.

#572 In Galxe/gravity-audit;

· keanji-x opened on Apr 18, 2026

[Low] EOA-target proposals execute as no-ops yet flip executed[id]=true permanently — IGovernance.isExecuted() returns true with zero on-chain effect

bugSomething isn't workingSomething isn't working

coacker:pendingCoacker pipeline labelCoacker pipeline label

repo: contractsIssue in on-chain contractsIssue in on-chain contracts

severity: lowLow risk, suggested improvementLow risk, suggested improvement

Status: Open.

#571 In Galxe/gravity-audit;

· keanji-x opened on Apr 18, 2026

[Medium] execute() bypasses resolve() via expired-unresolved SUCCEEDED branch — proposal flips to EXECUTED while isResolved=false / resolutionTime=0 / no ProposalResolved event

bugSomething isn't workingSomething isn't working

coacker:pendingCoacker pipeline labelCoacker pipeline label

repo: contractsIssue in on-chain contractsIssue in on-chain contracts

severity: mediumDefense-in-depth concern, plan to fixDefense-in-depth concern, plan to fix

Status: Open.

#570 In Galxe/gravity-audit;

· keanji-x opened on Apr 18, 2026

[Medium] OracleRequestQueue address reserved in SystemAddresses but absent from genesis CONTRACTS array — 0x1625F4002 is an EOA at runtime

bugSomething isn't workingSomething isn't working

coacker:pendingCoacker pipeline labelCoacker pipeline label

repo: contractsIssue in on-chain contractsIssue in on-chain contracts

severity: mediumDefense-in-depth concern, plan to fixDefense-in-depth concern, plan to fix

Status: Open.

#569 In Galxe/gravity-audit;

· keanji-x opened on Apr 18, 2026