https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/f368414e-fda4-45ec-a2f9-accc32823129.jpg

0xSmartContract

Security Researcher

|| Smart Contracts 🧭 || Code Review 📄 || Bot in Crypto 🤖 || Audit 📇 || c4 Warden 🐺 ||

Contact Me

High

Total

Medium

Total

$73.00K

Total Earnings

#114 All Time

112x

Payouts

1x

2nd Places

2x

3rd Places

34x

Top 10

All

Sherlock

Code4rena

Feb '24

AI Arena

216.02 USDC • Code4rena • 0xSmartContract

#27

HydraDX

118.22 USDC • Code4rena • 0xSmartContract

#17

Jan '24

Decent

186.33 USDC • 2 total findings • Code4rena • 0xSmartContract

#27

high

Due to missing checks on minimum gas passed through LayerZero, executions can fail on the destination chain

high

Anyone can update the address of the Router in the DcntEth contract to any address they would like to set.

Salty.IO

39.34 USDC • Code4rena • 0xSmartContract

#96

Curves

116.28 USDC • 1 total finding • Code4rena • 0xSmartContract

#44

high

Unauthorized Access to setCurves Function

Dec '23

Ethereum Credit Guild

892.68 USDC • Code4rena • 0xSmartContract

#17

Nov '23

Shell Protocol

44.92 USDC • Code4rena • 0xSmartContract

#10

Panoptic

479.29 USDC • Code4rena • 0xSmartContract

#17

Canto Application Specific Dollars and Bonding Curves for 1155s

288.91 USDC • Code4rena • 0xSmartContract

#10

Kelp DAO | rsETH

12.29 USDC • Code4rena • 0xSmartContract

#49

Oct '23

Party Protocol

575.73 USDC • Code4rena • 0xSmartContract

#14

Ethena Labs

88.73 USDC • Code4rena • 0xSmartContract

#32

The Wildcat Protocol

412.5 USDC • Code4rena • 0xSmartContract

#21

Brahma

14.47 USDC • Code4rena • 0xSmartContract

#14

ENS

85.67 USDC • Code4rena • 0xSmartContract

#12

Sep '23

Maia DAO - Ulysses

269.01 USDC • Code4rena • 0xSmartContract

#27

Aug '23

Dopex

832.85 USDC • Code4rena • 0xSmartContract

#26

Shell Protocol

441.46 USDC • Code4rena • 0xSmartContract

veRWA

47.92 USDC • Code4rena • 0xSmartContract

#38

Arbitrum Security Council Election System

627.26 USDC • Code4rena • 0xSmartContract

#12

PoolTogether V5: Part Deux

556.1 USDC • Code4rena • 0xSmartContract

#14

Tangible Caviar

0.72 USDC • Code4rena • 0xSmartContract

#86

Good Entry

158.78 USDC • Code4rena • 0xSmartContract

#25

Jul '23

Moonwell

69.77 USDC • Code4rena • 0xSmartContract

#35

Amphora Protocol

774.71 USDC • Code4rena • 0xSmartContract

PoolTogether

135.25 USDC • 1 total finding • Code4rena • 0xSmartContract

#53

medium

`VaultFactory` allows deployment of vaults with non-authentic `TwabController` and `PrizePool`

Tapioca DAO

2,276.11 USDC • 2 total findings • Code4rena • 0xSmartContract

#26

medium

Missing deadline checks allow pending transactions to be maliciously executed

medium

Oracle is susceptible to manipulation if deployed on Optimism

Basin

303.89 USDC • Code4rena • 0xSmartContract

#12

Nouns DAO

1,081.39 USDC • Code4rena • 0xSmartContract

Jun '23

Canto

348.84 USDC • Code4rena • 0xSmartContract

Llama

730.13 USDC • Code4rena • 0xSmartContract

Stader Labs

253.86 USDC • Code4rena • 0xSmartContract

#25

May '23

Maia DAO Ecosystem

3,084.68 USDC • 2 total findings • Code4rena • 0xSmartContract

#20

medium

[M-01] Some functions in Talos contracts does not allow user to supply slippage and deadline, which may cause swap revert

medium

Lack of slippage protection can lead to significant loss of user funds

Chainlink Cross-Chain Services: CCIP and ARM Network

59.42 USDC • Code4rena • 0xSmartContract

#43

USSD - Autonomous Secure Dollar

0.00 USDC • 3 total findings • Sherlock • 0xSmartContract

#101

high

No slippage protection in `UniV3SwapInput`

high

`mintRebalancer` and `burnRebalancer` functions haven't any access control

medium

Chainlink's latestRoundData might return stale or incorrect results

Juicebox Buyback Delegate

16.19 USDC • Code4rena • 0xSmartContract

#18

Venus Protocol Isolated Pools

101.57 USDC • Code4rena • 0xSmartContract

#39

Ajna Protocol

195.42 USDC • 1 total finding • Code4rena • 0xSmartContract

#37

high

Claiming accumulated rewards while the contract is underfunded can lead to a loss of rewards

Apr '23

EigenLayer Contest

90.02 USDC • Code4rena • 0xSmartContract

#24

ENS Contest

637.07 USDC • Code4rena • 0xSmartContract

#17

Frankencoin

43.63 USDC • Code4rena • 0xSmartContract

#60

Caviar Private Pools

506.27 USDC • 1 total finding • Code4rena • 0xSmartContract

#17

medium

The `tokenURI` method does not check if the NFT has been minted and returns data for the contract that may be a fake NFT.

Rubicon v2

742.78 USDC • Code4rena • 0xSmartContract

#17

Mar '23

Gitcoin

392.94 USDC • Sherlock • 0xSmartContract

Asymmetry contest

132.8 USDC • Code4rena • 0xSmartContract

#44

Canto Identity Subprotocols contest

278.11 USDC • Code4rena • 0xSmartContract

#13

Polynomial Protocol contest

103.46 USDC • Code4rena • 0xSmartContract

#29

zkSync Era System Contracts contest

237.7 USDC • Code4rena • 0xSmartContract

#11

Neo Tokyo contest

455.7 USDC • Code4rena • 0xSmartContract

Wenwin contest

251.21 USDC • Code4rena • 0xSmartContract

#18

Aragon Protocol contest

774.31 USDC • Code4rena • 0xSmartContract

Feb '23

Ethos Reserve contest

764.26 USDC • Code4rena • 0xSmartContract

#20

Fair Funding by Alchemix & Unstoppable

107.05 USDC • 1 total finding • Sherlock • 0xSmartContract

medium

`is_operator`architecture is wrong

Jan '23

Canto Identity Protocol contest

915.39 CANTO • Code4rena • 0xSmartContract

Popcorn contest

384.79 USDC • 1 total finding • Code4rena • 0xSmartContract

#42

medium

Fee on transfer token not supported

Numoen contest

1,042.54 USDC • Code4rena • 0xSmartContract

#10

Drips Protocol contest

254.8 USDC • Code4rena • 0xSmartContract

#10

RabbitHole Quest Protocol contest

230.95 USDC • Code4rena • 0xSmartContract

#21

Timeswap contest

1,678.01 USDC • Code4rena • 0xSmartContract

#10

Cooler

0.30 USDC • 1 total finding • Sherlock • 0xSmartContract

#30

high

Use safeTransferFrom() instead of transferFrom() for ERC20 transfers

OpenSea Seaport 1.2 contest

310.43 USDC • Code4rena • 0xSmartContract

Ondo Finance contest

735.46 USDC • Code4rena • 0xSmartContract

Reserve contest

1,126.63 USDC • Code4rena • 0xSmartContract

#18

Astaria contest

616.5 USDC • Code4rena • 0xSmartContract

#24

Biconomy - Smart Contract Wallet contest

1,208.86 USDC • 1 total finding • Code4rena • 0xSmartContract

medium

SmartAccount.sol is intended to be upgradable but inherits from contracts that contain storage and no gaps

Dec '22

Papr contest

394.79 USDC • Code4rena • 0xSmartContract

#18

GoGoPool contest

1,198.27 USDC • 1 total finding • Code4rena • 0xSmartContract

#23

high

Inflation of ggAVAX share price by first depositor

Caviar contest

1,222.8 USDC • Code4rena • 0xSmartContract

prePO contest

840.61 USDC • Code4rena • 0xSmartContract

#10

Tigris Trade contest

1,223.44 USDC • 1 total finding • Code4rena • 0xSmartContract

#17

medium

Centralization risks: owner can freeze withdraws and use timelock to steal all funds

Escher contest

624.4 USDC • Code4rena • 0xSmartContract

#12

Maverick contest

1,432.53 USDC • Code4rena • 0xSmartContract

PoolTogether contest

795.08 USDC • Code4rena • 0xSmartContract

Nov '22

ParaSpace contest

882.55 USDC • Code4rena • 0xSmartContract

#26

Canto contest

758.1 CANTO • Code4rena • 0xSmartContract

Redacted Cartel contest

1,058.24 USDC • 2 total findings • Code4rena • 0xSmartContract

#16

high

Malicious Users Can Drain The Assets Of Auto Compound Vault

high

Underlying assets stealing in `AutoPxGmx` and `AutoPxGlp` via share price manipulation

Bull v Bear

306.83 USDC • 1 total finding • Sherlock • 0xSmartContract

#10

high

Missing ReEntrancy Guard to `withdrawToken` function

LSD Network - Stakehouse contest

2,322.49 USDC • 1 total finding • Code4rena • 0xSmartContract

#12

medium

Cross-chain replay attacks are possible with `deployLPToken`

Blur Exchange contest

1,193.9 USDC • 1 total finding • Code4rena • 0xSmartContract

medium

Hacked owner or malicious owner can immediately steal all assets on the platform

LooksRare Aggregator contest

5,205.96 USDC • 1 total finding • Code4rena • 0xSmartContract

medium

It is clearly stated that timelock is used, but this does not happen in the codes

SIZE contest

73.96 USDC • 1 total finding • Code4rena • 0xSmartContract

#28

medium

Incompatibility with fee-on-transfer/inflationary/deflationary/rebasing tokens, on both base tokens and quote tokens, with varying impacts

Debt DAO contest

691.09 USDC • 1 total finding • Code4rena • 0xSmartContract

#26

medium

Mistakenly sent eth could be locked

Sense

2,352.73 USDC • 2 total findings • Sherlock • 0xSmartContract

high

First `ERC4626` deposit exploit can break share calculation

medium

Vulnerability related to ‘Optimizer Bug Regarding Memory Side Effects of Inline Assembly’

Oct '22

zkSync v2 contest

2,102.32 USDC • Code4rena • 0xSmartContract

Paladin - Warden Pledges contest

391.01 USDC • 1 total finding • Code4rena • 0xSmartContract

#14

medium

Pausing `WardenPledge` contract, which takes effect immediately, by its owner can unexpectedly block pledge creator from calling `closePledge` or `retrievePledgeRewards` function

Inverse Finance contest

691.21 USDC • Code4rena • 0xSmartContract

#14

NFTPort

1,324.75 USDC • 1 total finding • Sherlock • 0xSmartContract

medium

Missing ReEntrancy Guard to `mint` function

Holograph contest

771.29 USDC • Code4rena • 0xSmartContract

#15

3xcalibur contest

570.47 USDC • Code4rena • 0xSmartContract

#13

Juicebox contest

367.96 USDC • Code4rena • 0xSmartContract

#15

Trader Joe v2 contest

2,351.98 USDC • 1 total finding • Code4rena • 0xSmartContract

#10

medium

Very critical `Owner` privileges can cause complete destruction of the project in a possible privateKey exploit

The Graph L2 bridge contest

1,054.18 USDC • Code4rena • 0xSmartContract

Blur Exchange contest

83.13 USDC • 1 total finding • Code4rena • 0xSmartContract

#21

medium

Hacked owner or malicious owner can immediately steal all assets on the platform

Sep '22

QuickSwap and StellaSwap contest

466.16 USDC • 2 total findings • Code4rena • 0xSmartContract

#14

medium

A "FrontRunning attack" can be made to the `initialize` function

medium

`safeTransfer` function does not check for existence of ERC20 token contract

Frax Ether Liquid Staking contest

91.75 USDC • 2 total findings • Code4rena • 0xSmartContract

#31

medium

Centralization risk: admin have privileges: admin can set address to mint any amount of frxETH, can set any address as validator, and change important state in frxETHMinter and withdraw fund from frcETHMinter

medium

frxETHMinter: Non-conforming ERC20 tokens not recoverable