Issues

• Sunset Acala and Karura

  Maintenance workXCM Tools
  paraspell/xcm-tools#2472 · Filter by author dudo50 opened on Nov 9, 2026

• [Bug bounty] Playground: ahAddress URL parameter silently becomes the XCM SetAppendix refund beneficiary on substrate-origin transfers

  Bug bounty 💰
  paraspell/xcm-tools#2468 · Filter by author rihid opened on Nov 8, 2026
  1

  

• [Bug bounty] Type-and-then: existential deposit added twice for non-sufficient fee assets

  Bug bounty 💰
  paraspell/xcm-tools#2465 · Filter by author rihid opened on Nov 8, 2026
  

• [Bug bounty] DuplicateAssetError guard bypass in findEthMatch allows ambiguous symbol to silently resolve to the first ERC20 contract (wrong-asset transfer to Ethereum)

  Bug bounty 💰
  paraspell/xcm-tools#2461 · Filter by author syarifchelsea opened on Nov 8, 2026
  2

  

• [Bug bounty] Pool eviction destroys in-use client cache entries (refs > 0) on overflow

  paraspell/xcm-tools#2459 · Filter by author JuanAlfonsus opened on Nov 8, 2026
  1

• [Bug bounty] Playground custom-config import accepts malformed inner entries and bricks the app on every load

  Bug bounty 💰
  paraspell/xcm-tools#2457 · Filter by author steffanomcrey opened on Nov 8, 2026
  

• [Bug bounty] Playground custom asset modal silently fails on fractional decimals

  Bug bounty 💰
  paraspell/xcm-tools#2456 · Filter by author steffanomcrey opened on Nov 8, 2026
  1

  

• [Bug bounty] xcmFormatCheck option is ignored for batch transfers (buildBatch / x-transfer-batch)

  Bug bounty 💰
  paraspell/xcm-tools#2454 · Filter by author derioii opened on Nov 7, 2026
  2

  

• [Bug bounty] sdk-core: createCustomXcm sets isFeeTransferred = false on multi-asset (overriddenAsset) ED transfers, swapping entire fee asset via ExchangeAsset maximal: true

  Bug bounty 💰
  paraspell/xcm-tools#2452 · Filter by author hamzy-hams opened on Nov 7, 2026
  1

  

• [Bug bounty] verifyEdOnDestinationInternal miscalculates fee deductions for custom feeAsset and PolkadotXcm.execute transfers

  paraspell/xcm-tools#2450 · Filter by author LBCron opened on Nov 7, 2026
  2

• [Bug bounty] Swap: canBuildToExchangeTx calls BigInt(amount) before applyDecimalAbstraction, swallowing SyntaxError on fractional amounts and bypassing route validation

  Bug bounty 💰
  paraspell/xcm-tools#2447 · Filter by author hamzy-hams opened on Nov 7, 2026
  1

  

• [Bug bounty] sumHopFees (type-and-then), calculateTotalXcmFee (verifyEdOnDestination), and aggregateHopFees (getTransferInfo / getExecuteSwapInfo) use raw isAssetEqual instead of api.isAssetXcEqual across chains

  Bug bounty 💰
  paraspell/xcm-tools#2446 · Filter by author hamzy-hams opened on Nov 7, 2026
  1

  

• [Bug bounty] String amounts in scientific notation ("1e21", "1e-7") crash with an untyped SyntaxError or are rejected, while identical numeric amounts parse - string branch missed by the #2184 fix

  paraspell/xcm-tools#2445 · Filter by author ruida-niu opened on Nov 7, 2026

• [Bug bounty] SDK: getTransferInfo ignores the amount in xcmFee.balanceAfter on native transfers and reports sufficient: true when the fee can't be paid

  Bug bounty 💰
  paraspell/xcm-tools#2443 · Filter by author codeNinja62 opened on Nov 6, 2026
  1

  

• Remove feeAsset parameter from computeOriginFee functions

  Maintenance workXCM SDK
  paraspell/xcm-tools#2441 · Filter by author michaeldev5 opened on Nov 6, 2026
  

• [Bug bounty] Wrong custom-chain decimals silently mis-scale the full transfer amount

  Bug bounty 💰
  paraspell/xcm-tools#2438 · Filter by author sBekk opened on Nov 5, 2026
  

• [Bug bounty] Execute builders return a signable transaction after their own dry run reports a hop or destination failure

  Bug bounty 💰
  paraspell/xcm-tools#2437 · Filter by author sBekk opened on Nov 5, 2026
  1

  

• [Bug bounty] Playground keeps a stale currency selection after a chain change and builds a transfer of a different asset

  Bug bounty 💰
  paraspell/xcm-tools#2436 · Filter by author sBekk opened on Nov 5, 2026
  

• Remove redundant && asset check from PAPI / PJS client code

  Maintenance workXCM SDK
  paraspell/xcm-tools#2434 · Filter by author michaeldev5 opened on Nov 5, 2026

• [Bug bounty][Medium] XCM API: assetId accepts JSON numbers > 2^53 — silent float rounding forwards a wrong assetId to the SDK

  paraspell/xcm-tools#2433 · Filter by author 0xgilang-node opened on Nov 5, 2026
  1

• [Bug bounty][Medium] Swap: Acala & Bifrost omit destination XCM fee from reported amountOut for non-native outputs (user overquoted)

  paraspell/xcm-tools#2432 · Filter by author 0xgilang-node opened on Nov 5, 2026
  1

• [Bug bounty][Medium] Playground: URL-prefilled transactOptions.call → one-click signing of hidden arbitrary inner call (+ frameable hosts)

  paraspell/xcm-tools#2431 · Filter by author 0xgilang-node opened on Nov 5, 2026
  1

• [Bug bounty][High] XCM API: legacy /v1 prefix serves a stale pre-2026-08-11 build — all analyser/validation fixes unfixed there

  paraspell/xcm-tools#2430 · Filter by author 0xgilang-node opened on Nov 5, 2026
  1

• [Bug bounty][High] Swap: Hydration fee-estimation quote is 10^decimals oversized (raw planck string fed to human-decimal GC sdk)

  paraspell/xcm-tools#2429 · Filter by author 0xgilang-node opened on Nov 5, 2026
  1

• [Bug bounty][High] Swap execute-path: multi-hop want halving causes hop-2 NoDeal → funds trapped in pallet holding

  paraspell/xcm-tools#2428 · Filter by author 0xgilang-node opened on Nov 5, 2026