https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/13526f66-5315-42a6-8175-d2f97a88a16f.jpg

0xNazgul

Security Researcher

FIRST UNIVERSAL CYBERNETIC-KINETIC ULTRA-MICRO PROGRAMMER @OpenZeppelin

Contact Me

High

Total

Medium

Total

$24.85K

Total Earnings

#322 All Time

87x

Payouts

1x

3rd Places

8x

Top 10

33x

Top 25

All

Sherlock

Code4rena

Jul '24

Velocimeter

13.20 USDC • 2 total findings • Sherlock • 0xNazgul

#51

high

Claimable gauge distributions are locked when `pauseGauge` is called

medium

First liquidity provider of a stable pair can DOS the pool

Jan '23

Popcorn contest

2,246.26 USDC • 5 total findings • Code4rena • 0xNazgul

high

First vault depositor can steal other's assets

high

Staking rewards can be drained

medium

Fee on transfer token not supported

medium

[NAZ-M1] Vault Fees Can Total To More Than `1e18`

medium

[NAZ-M2] Unchecked return of `execute()`

Reserve contest

121.59 USDC • Code4rena • 0xNazgul

#26

UXD Protocol

1,453.53 USDC • 2 total findings • Sherlock • 0xNazgul

high

[NAZ-H1] Any Account That Has `PerpDepository.sol` Approved as Spender of `quoteToken` Can be Forced To Pay Shortfall

high

[NAZ-M7] `DnGmxSeniorVault.sol` Has a `maxUtilizationBps` Cap on Withdraws But `RageDnDepository.sol` Has No Soft Cap For This

Dec '22

GoGoPool contest

35.35 USDC • 2 total findings • Code4rena • 0xNazgul

#72

high

Inflation of ggAVAX share price by first depositor

medium

wrong reward distribution between early and late depositors because of the late syncRewards() call in the cycle, syncReward() logic should be executed in each withdraw or deposits (without reverting)

Tigris Trade contest

207.5 USDC • 2 total findings • Code4rena • 0xNazgul

#40

medium

Must approve 0 first

medium

Centralization risks: owner can freeze withdraws and use timelock to steal all funds

prePO contest

28.12 USDC • Code4rena • 0xNazgul

#31

Escher contest

320.32 USDC • 1 total finding • Code4rena • 0xNazgul

#18

medium

Escher721 contract does not have setTokenRoyalty function

Nov '22

ParaSpace contest

923.33 USDC • 2 total findings • Code4rena • 0xNazgul

#25

high

Anyone can prevent themselves from being liquidated as long as they hold one of the supported NFTs

medium

During oracle outages or feeder outages/disagreement, the `ParaSpaceFallbackOracle` is not used

Redacted Cartel contest

53.49 USDC • Code4rena • 0xNazgul

#46

LSD Network - Stakehouse contest

475.56 USDC • Code4rena • 0xNazgul

#29

Blur Exchange contest

42.55 USDC • Code4rena • 0xNazgul

#29

DODO

62.49 USDC • 1 total finding • Sherlock • 0xNazgul

medium

[NAZ-M2] Usage of deprecated `transfer()` can result in revert.

Debt DAO contest

61.35 USDC • Code4rena • 0xNazgul

#51

Oct '22

Paladin - Warden Pledges contest

31.16 USDC • Code4rena • 0xNazgul

#30

Inverse Finance contest

37.11 USDC • 1 total finding • Code4rena • 0xNazgul

#42

medium

Chainlink oracle data feed is not sufficiently validated and can return stale `price`

Astaria

63.28 USDC • 2 total findings • Sherlock • 0xNazgul

#28

medium

[NAZ-M1] First ERC4626 vault deposit exploit can break share calculation

medium

[NAZ-M2] Incorrect Logic Comparison

Holograph contest

549.04 USDC • Code4rena • 0xNazgul

#19

3xcalibur contest

2,247.23 USDC • Code4rena • 0xNazgul

Juicebox contest

37.88 USDC • Code4rena • 0xNazgul

#18

The Graph L2 bridge contest

71.07 USDC • Code4rena • 0xNazgul

#14

Blur Exchange contest

83.13 USDC • Code4rena • 0xNazgul

#21

Sep '22

Knox Finance

3,047.92 USDC • 2 total findings • Sherlock • 0xNazgul

high

[NAZ-M6] Unbounded loop in `_previewWithdraw() && _redeemMax()` Can Lead To DoS

medium

[NAZ-M2] Lack of Price Freshness Check In `_latestAnswer64x64()` Allows A Stale Price To Be Used

QuickSwap and StellaSwap contest

586.05 USDC • 1 total finding • Code4rena • 0xNazgul

#13

medium

A "FrontRunning attack" can be made to the `initialize` function

Frax Ether Liquid Staking contest

96.07 USDC • Code4rena • 0xNazgul

#30

VTVL contest

60.12 USDC • 1 total finding • Code4rena • 0xNazgul

#45

medium

Supply cap of VariableSupplyERC20Token is not properly enforced

Art Gobblers contest

123.86 USDC • Code4rena • 0xNazgul

#19

Harpie

170.22 USDC • 2 total findings • Sherlock • 0xNazgul

#11

medium

[NAZ-H1] ECDSA Signature Malleability

medium

[NAZ-M1] Using `transferFrom` On ERC721 Tokens

Y2k Finance contest

175.3 USDC • 1 total finding • Code4rena • 0xNazgul

#32

high

Griefing attack on the Vaults is possible, withdrawing the winning side stakes

PartyDAO contest

198.1 USDC • Code4rena • 0xNazgul

#23

FEI and TRIBE Redemption contest

33.81 USDC • Code4rena • 0xNazgul

#11

Canto Dex Oracle contest

146.62 CANTO • 1 total finding • Code4rena • 0xNazgul

#10

medium

Calculated `token0TVL` may be zero under certain scenarios

Nouns Builder contest

90.77 USDC • Code4rena • 0xNazgul

#90

Aug '22

Sentiment

3.50 USDC • 1 total finding • Sherlock • 0xNazgul

#26

medium

[NAZ-M4] Chainlink's `latestRoundData` Might Return Stale Results

Olympus DAO contest

584.04 USDC • 2 total findings • Code4rena • 0xNazgul

#32

medium

No Cap on Amount of VOTES means the `voter_admin` can get any proposal to pass

medium

[NAZ-M1] Chainlink's `latestRoundData` Might Return Stale Results

Nouns DAO contest

224.81 USDC • Code4rena • 0xNazgul

#15

FIAT DAO veFDT contest

54.24 USDC • Code4rena • 0xNazgul

#42

Fraxlend (Frax Finance) contest

99.85 USDC • Code4rena • 0xNazgul

#28

Foundation Drop contest

63.31 USDC • Code4rena • 0xNazgul

#42

Mimo August 2022 contest

2,436.29 USDC • 1 total finding • Code4rena • 0xNazgul

medium

`vaultOwner` Can Front-Run `rebalance()` With `setAutomation()` To Lower Incentives

Rigor Protocol contest

373.8 USDC • 1 total finding • Code4rena • 0xNazgul

#24

medium

Builders must pay more interest when the system is paused.

Jul '22

Axelar Network v2 contest

88.08 USDC • Code4rena • 0xNazgul

#29

Golom contest

189.05 USDC • Code4rena • 0xNazgul

#54

Yield Witch v2 contest

83.86 USDC • Code4rena • 0xNazgul

#12

Swivel v3 contest

77.05 USDC • Code4rena • 0xNazgul

#35

ENS contest

123.53 USDC • Code4rena • 0xNazgul

#46

Fractional v2 contest

201.39 USDC • 1 total finding • Code4rena • 0xNazgul

#48

medium

`fallback()` function can bypass permission/auth checks imposed in `execute()`

Juicebox V2 contest

147.37 USDC • Code4rena • 0xNazgul

#33

Jun '22

Putty contest

75.27 USDC • Code4rena • 0xNazgul

#55

Nibbl contest

47.59 USDC • Code4rena • 0xNazgul

#30

Yieldy contest

111.21 USDC • Code4rena • 0xNazgul

#43

Illuminate contest

126.4 USDC • Code4rena • 0xNazgul

#51

Nested Finance contest

631.81 USDC • Code4rena • 0xNazgul

Badger-Vested-Aura contest

132.64 USDC • Code4rena • 0xNazgul

#21

Infinity NFT Marketplace contest

84.25 USDC • Code4rena • 0xNazgul

#48

Canto contest

513.69 USDC • Code4rena • 0xNazgul

#32

Connext Amarok contest

226.92 USDC • Code4rena • 0xNazgul

#41

Notional x Index Coop

135.59 USDC • Code4rena • 0xNazgul

#34

May '22

Backd Tokenomics contest

171.81 USDC • Code4rena • 0xNazgul

#26

veToken Finance contest

262.4 USDT • 1 total finding • Code4rena • 0xNazgul

#32

medium

Misconfiguration of Fees Incentive Might Cause Tokens To Be Stuck In `Booster` Contract

Velodrome Finance contest

644.68 USDC • Code4rena • 0xNazgul

#17

Rubicon contest

86.32 USDC • Code4rena • 0xNazgul

#56

Sturdy contest

93.84 USDC • Code4rena • 0xNazgul

#24

Aura Finance contest

301.04 USDC • Code4rena • 0xNazgul

#22

Cally contest

30.09 USDC • Code4rena • 0xNazgul

#76

Enso Finance contest

303.01 USDT • Code4rena • 0xNazgul

#32

Alchemix contest

305.02 DAI • Code4rena • 0xNazgul

#21

FactoryDAO contest

59.77 DAI • Code4rena • 0xNazgul

#56

Cudos contest

96.72 USDC • Code4rena • 0xNazgul

#44

Forgotten Runes Warrior Guild contest

15.49 USDC • Code4rena • 0xNazgul

#57

bunker.finance contest

383.36 USDC • 1 total finding • Code4rena • 0xNazgul

#11

medium

Chainlink pricer is using a deprecated API

Apr '22

Mimo DeFi contest

148.39 USDC • Code4rena • 0xNazgul

#20

AbraNFT contest

48.92 MIM • Code4rena • 0xNazgul

#49

Backd contest

89.35 USDC • Code4rena • 0xNazgul

#40

xTRIBE contest

78.14 USDC • Code4rena • 0xNazgul

#33

Phuture Finance contest

49.45 USDC • Code4rena • 0xNazgul

#29

Badger Citadel contest

54.33 USDC • Code4rena • 0xNazgul

#56

JPEG'd contest

123.75 USDC • Code4rena • 0xNazgul

#46

Axelar Network contest

131.23 USDC • Code4rena • 0xNazgul

#14

Mar '22

Volt Protocol contest

78.91 USDC • Code4rena • 0xNazgul

#29

Joyn contest

34.11 USDC • Code4rena • 0xNazgul

#38

Paladin contest

52.84 USDC • Code4rena • 0xNazgul

#37

Sublime contest

41.55 USDC • Code4rena • 0xNazgul

#23

LI.FI contest

63 USDC • Code4rena • 0xNazgul

#55

prePO contest

81.24 USDC • Code4rena • 0xNazgul

#23

Maple Finance contest

111.36 USDC • Code4rena • 0xNazgul

#11

Biconomy Hyphen 2.0 contest

178.72 USDT • Code4rena • 0xNazgul

#41