https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/c708b1d2-7bbd-40b2-9b85-538761b50492.jpg

0xShoonya

Security Researcher

Guarding the chain, one slot at a time.

Contact Me

High

Total

Medium

Total

$4.71K

Total Earnings

#823 All Time

18x

Payouts

3x

Top 10

7x

Top 25

11x

Top 50

All

Sherlock

Code4rena

Jul '25

Mellow Flexible Vaults

524.62 USDC • 5 total findings • Sherlock • 0xShoonya

#19

high

`checkSignatures` counts duplicate signers toward the approval threshold

medium

Incorrect fenwick tree index usage leads to DOS in `cancelDepositRequest`

medium

ETH redemptions via `SignatureRedeemQueue` are broken due to missing `receive` function

medium

Incorrect logic in `ShareManager.updateChecks` blocks transfers from whitelisted senders when `hasTransferWhitelist` is enabled

medium

Single wei deficit in `stETH` deposit DoS's entire vault pipeline

DeBank

63.53 USDC • Sherlock • 0xShoonya

#42

Notional Exponent

137.53 USDC • 2 total findings • Sherlock • 0xShoonya

#31

medium

Hardcoded WETH Address in `Constants.sol`

medium

Incorrect chain-specific logic for convex integration prevents deployment on Arbitrum and Base

Jun '25

Symbiotic Relay

2,796.16 USDC • 2 total findings • Sherlock • 0xShoonya

medium

Permanent Lockout from Vault Auto-Deployment due to Stale State

medium

Unbounded-Loop DoS in `VotingPowerProviderLogic`

DODO Cross-Chain DEX

24.32 USDC • 2 total findings • Sherlock • 0xShoonya

#45

high

Unauthorized fund claim for Solana cross-chain refunds via flawed recipient Determination

medium

Users' assets sent to Bitcoin will be permanently lost if the cross-chain transfer reverts.

May '25

Native Smart Contract V2

599.26 USDC • Sherlock • 0xShoonya

#14

Findings not publicly available for private contests.

Jan '25

Liquid Ron

0 USDC • 1 total finding • Code4rena • honey-k12

#12

medium

Incorrect Logic in onlyOperator Modifier Leading to Denial-of-Service for Authorized Operators Across Critical Functions

Dec '24

SecondSwap

0.38 USDC • 1 total finding • Code4rena • honey-k12

#65

medium

Incorrect listing type validation bypasses enforcement of minimum purchase amount

Oku's New Order Types Contract Contest

0.01 OP • 1 total finding • Sherlock • 0xShoonya

#65

medium

Wrong Price Staleness Check in `currentValue()` Causes Outdated Prices to be used in the Protocol

Lambo.win

0 USDC • 1 total finding • Code4rena • honey-k12

#36

high

Minting zero tokens when underlyingToken is not Ether in cashIn()

Nov '24

MANTRA DEX

96.48 USDC • 2 total findings • Code4rena • honey-k12

#21

medium

`withdraw_liquidity` lacks slippage protection

medium

Liquidity providers can lose tokens due to disproportionate deposits not being properly handled

Concrete

27.05 USDC • Code4rena • honey-k12

#80

Oct '24

predict.fun lending market

421.53 USDC • 1 total finding • Sherlock • 0xShoonya

medium

Incorrect encoding of `questionId` field in `hashProposal` function breaks `EIP-712` compatibility

Jul '24

Velocimeter

2.20 USDC • 1 total finding • Sherlock • 0xShoonya

#53

medium

First liquidity provider of a stable pair can DOS the pool

Apr '24

Renzo

1.89 USDC • 3 total findings • Code4rena • honey-k12

#52

high

Incorrect withdraw queue balance in TVL calculation

high

Withdrawals logic allows MEV exploits of TVL changes and zero-slippage zero-fee swaps

medium

Lack of slippage and deadline during withdraw and deposit

NOYA

10.49 USDC + NOYA stars • 2 total findings • Code4rena • honey-k12

#93

medium

Missing calls to `_updateTokenInRegistry` leads to incorrect state of tokens in registry

medium

`Keepers` does not implement EIP712 correctly on multiple occasions

Feb '24

AI Arena

0.04 USDC • 1 total finding • Code4rena • honey-k12

#185

medium

Can mint NFT with the desired attributes by reverting transaction