Issues

• [Bug bounty] verifyEdOnDestinationInternal miscalculates fee deductions for custom feeAsset and PolkadotXcm.execute transfers

  paraspell/xcm-tools#2450 · Filter by author LBCron opened on Nov 7, 2026

• [Bug bounty] verifyEdOnDestinationInternal miscalculates fee deductions for custom feeAsset and PolkadotXcm.execute transfers

  paraspell/xcm-tools#2449 · Filter by author LBCron opened on Nov 7, 2026

• [Bug bounty] Swap: canBuildToExchangeTx calls BigInt(amount) before applyDecimalAbstraction, swallowing SyntaxError on fractional amounts and bypassing route validation

  Bug bounty 💰
  paraspell/xcm-tools#2447 · Filter by author hamzy-hams opened on Nov 7, 2026
  1

  

• [Bug bounty] sumHopFees (type-and-then), calculateTotalXcmFee (verifyEdOnDestination), and aggregateHopFees (getTransferInfo / getExecuteSwapInfo) use raw isAssetEqual instead of api.isAssetXcEqual across chains

  Bug bounty 💰
  paraspell/xcm-tools#2446 · Filter by author hamzy-hams opened on Nov 7, 2026
  1

  

• [Bug bounty] String amounts in scientific notation ("1e21", "1e-7") crash with an untyped SyntaxError or are rejected, while identical numeric amounts parse - string branch missed by the #2184 fix

  paraspell/xcm-tools#2445 · Filter by author ruida-niu opened on Nov 7, 2026

• [Bug bounty] SDK: getTransferInfo ignores the amount in xcmFee.balanceAfter on native transfers and reports sufficient: true when the fee can't be paid

  Bug bounty 💰
  paraspell/xcm-tools#2443 · Filter by author codeNinja62 opened on Nov 6, 2026
  

• Remove feeAsset parameter from computeOriginFee functions

  Maintenance workXCM SDK
  paraspell/xcm-tools#2441 · Filter by author michaeldev5 opened on Nov 6, 2026
  

• [Bug bounty] Wrong custom-chain decimals silently mis-scale the full transfer amount

  Bug bounty 💰
  paraspell/xcm-tools#2438 · Filter by author sBekk opened on Nov 5, 2026
  

• [Bug bounty] Execute builders return a signable transaction after their own dry run reports a hop or destination failure

  Bug bounty 💰
  paraspell/xcm-tools#2437 · Filter by author sBekk opened on Nov 5, 2026
  1

  

• [Bug bounty] Playground keeps a stale currency selection after a chain change and builds a transfer of a different asset

  Bug bounty 💰
  paraspell/xcm-tools#2436 · Filter by author sBekk opened on Nov 5, 2026
  

• Remove redundant && asset check from PAPI / PJS client code

  Maintenance workXCM SDK
  paraspell/xcm-tools#2434 · Filter by author michaeldev5 opened on Nov 5, 2026

• [Bug bounty][Medium] XCM API: assetId accepts JSON numbers > 2^53 — silent float rounding forwards a wrong assetId to the SDK

  paraspell/xcm-tools#2433 · Filter by author 0xgilang-node opened on Nov 5, 2026
  1

• [Bug bounty][Medium] Swap: Acala & Bifrost omit destination XCM fee from reported amountOut for non-native outputs (user overquoted)

  paraspell/xcm-tools#2432 · Filter by author 0xgilang-node opened on Nov 5, 2026
  1

• [Bug bounty][Medium] Playground: URL-prefilled transactOptions.call → one-click signing of hidden arbitrary inner call (+ frameable hosts)

  paraspell/xcm-tools#2431 · Filter by author 0xgilang-node opened on Nov 5, 2026
  1

• [Bug bounty][High] XCM API: legacy /v1 prefix serves a stale pre-2026-08-11 build — all analyser/validation fixes unfixed there

  paraspell/xcm-tools#2430 · Filter by author 0xgilang-node opened on Nov 5, 2026
  1

• [Bug bounty][High] Swap: Hydration fee-estimation quote is 10^decimals oversized (raw planck string fed to human-decimal GC sdk)

  paraspell/xcm-tools#2429 · Filter by author 0xgilang-node opened on Nov 5, 2026
  1

• [Bug bounty][High] Swap execute-path: multi-hop want halving causes hop-2 NoDeal → funds trapped in pallet holding

  paraspell/xcm-tools#2428 · Filter by author 0xgilang-node opened on Nov 5, 2026

• [Bug bounty][High] Assets registry coverage gap: 45 parachains with live HRMP channels missing from assets.json

  paraspell/xcm-tools#2427 · Filter by author 0xgilang-node opened on Nov 5, 2026

• [Bug bounty][High] Assets registry: HOLLAR location malformed (on-chain = AccountKey20 ERC20) — XCM routing via location fails for Hydration

  paraspell/xcm-tools#2426 · Filter by author 0xgilang-node opened on Nov 5, 2026

• Simplify type_and_then decision logic in Substrate chain class

  Maintenance workXCM SDK
  paraspell/xcm-tools#2424 · Filter by author michaeldev5 opened on Nov 5, 2026

• [Bug bounty] The XCM API batch route can never use custom chains (the batch DTO strips them before the assertion reads them), and the failure surfaces as HTTP 500 instead of 400

  Bug bounty 💰
  paraspell/xcm-tools#2401 · Filter by author juantzy7 opened on Nov 5, 2026
  

• Remove XCM V3

  Maintenance workXCM Tools
  paraspell/xcm-tools#2399 · Filter by author dudo50 opened on Nov 4, 2026

• [Bug bounty] Custom chains: several Builder methods and amount 'ALL' throw "Custom chain … is not registered" because the chain is used before api.init() hydrates it

  Bug bounty 💰
  paraspell/xcm-tools#2398 · Filter by author exxbrain opened on Nov 4, 2026
  

• [Bug bounty] SWAP: convertBuilderConfig rejects string[] apiOverrides as "non-string values", so every swap operation fails when an override is a list of RPC URLs

  Bug bounty 💰
  paraspell/xcm-tools#2395 · Filter by author exxbrain opened on Nov 4, 2026
  1

  

• [Bug bounty] Symbol lookup with an Ethereum destination only searches Ethereum-origin assets with chainId 1: DOT/KSM/MYTH cannot be selected by symbol for Snowbridge transfers, and no symbol resolves for EthereumTestnet

  Bug bounty 💰
  paraspell/xcm-tools#2394 · Filter by author exxbrain opened on Nov 4, 2026