https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/25bbde57-5828-4758-ad80-b60d6f8090d0.jpg

0xTheC0der

Security Researcher

Ξ Smart contract security researcher Decentralizing the future, block by block Available for security reviews | https://t.co/8gPqPqTEot https://t.co/rTMEE5zX3S

Contact Me

High

14

Total

Medium

16

Total

$62.12K

Total Earnings

#152 All Time

26x

Payouts

gold

1x

1st Places

silver

1x

2nd Places

bronze

3x

3rd Places

All

Sherlock

Code4rena

Cantina

Mar '24

Acala

Acala

517.79 USDC • 1 total finding • Code4rena • 0xTheC0der

#13

medium

Incentive accumulation can be sandwiched with additional shares to gain advantage over long-term depositors

Phat Contract Runtime

Phat Contract Runtime

12,619.42 USDC • 1 total finding • Code4rena • 0xTheC0der

bronze

medium

Limited availability of `balance_of(...)` method

Jan '24

lockbox-solana

lockbox-solana

8,590.35 USDC • 2 total findings • Cantina • 0xTheC0der

silver

medium

Finding not yet public.

medium

Finding not yet public.

Opus

Opus

9,786.31 USDC • Code4rena • 0xTheC0der

bronze

Dec '23

Olas

Olas

437.1 USDC • 1 total finding • Code4rena • 0xTheC0der

#11

high

Bonds created in year cross epoch's can lead to lost payouts

Nov '23

core-and-erc1155a

core-and-erc1155a

852.1 USDC • 1 total finding • Cantina • 0xTheC0der

#15

medium

Finding not yet public.

Oct '23

Canto Liquidity Mining Protocol

Canto Liquidity Mining Protocol

4.94 USDC • Code4rena • 0xTheC0der

#19

zkSync Era

zkSync Era

1,540.24 USDC • Code4rena • 0xTheC0der

#24

Sep '23

Venus Prime

Venus Prime

719.26 USDC • 1 total finding • Code4rena • 0xTheC0der

#9

high

Incorrect decimal usage in score calculation leads to reduced user reward earnings

Maia DAO - Ulysses

Maia DAO - Ulysses

0.15 USDC • 1 total finding • Code4rena • 0xTheC0der

#61

high

All tokens can be stolen from `VirtualAccount` due to missing access modifier

Aug '23

Chainlink Staking v0.2

Chainlink Staking v0.2

41.45 USDC • Code4rena • 0xTheC0der

#57

Dopex

Dopex

20.7 USDC • 1 total finding • Code4rena • 0xTheC0der

#105

medium

Change of `fundingDuration` causes "time travel" of `PerpetualAtlanticVault.nextFundingPaymentTimestamp()`

Arbitrum Security Council Election System

Arbitrum Security Council Election System

1,379.86 USDC • 1 total finding • Code4rena • 0xTheC0der

#8

medium

SecurityCouncilNomineeElectionGovernor might have to wait for more than 6 months to create election again

Jul '23

Tokemak

Tokemak

94.58 USDC • 2 total findings • Sherlock • 0xTheC0der

#45

high

Rewards can be drained due to incorrect handling of `userRewardPerTokenPaid` accounting

high

LiquidationRow.liquidateVaultsForToken(...) will always revert due to missing token transfers

Axelar Network

Axelar Network

4,711.2 USDC • 1 total finding • Code4rena • 0xTheC0der

#5

medium

Insufficient support for tokens with different decimals on different chains lead to loss of funds on cross-chain bridging

Tapioca DAO

Tapioca DAO

1,078.89 USDC • 3 total findings • Code4rena • 0xTheC0der

#44

high

Tokens can be stolen from other users who have approved Magnetar

high

User can give himself approval for all assets held by `MagnetarV2` contract

medium

`MagnetarV2#burst` double counts `msg.value` for `TOFT_WRAP` operation, making the transaction revert unless the user overpays

May '23

Maia DAO Ecosystem

Maia DAO Ecosystem

4,174.82 USDC • 7 total findings • Code4rena • 0xTheC0der

#16

high

`UlyssesToken` asset ID accounting error

high

Multiple issues with decimal scaling will cause incorrect accounting of hTokens and underlying tokens

medium

`UlyssesToken.setWeights(...)` can cause user loss of assets on vault deposits/withdrawals

medium

Unstaking `vMAIA` tokens on the first Tuesday of the month can be offset

medium

Claiming outstanding utility tokens from `vMaia` vault DoS on `pbHermes<>bHermes` conversion rate > 1

medium

Maia Governance token balance dilution in `vMaia` vault is breaking the conversion rate mechanism

medium

`RootBridgeAgent.redeemSettlement` can be front-run using `RootBridgeAgent.retrySettlement` causing redeem DoS

Chainlink Cross-Chain Services: CCIP and ARM Network

Chainlink Cross-Chain Services: CCIP and ARM Network

929.19 USDC • Code4rena • 0xTheC0der

#25

BASE

BASE

813.4 USDC • Code4rena • 0xTheC0der

bronze
Ajna Protocol

Ajna Protocol

104.03 USDC • 2 total findings • Code4rena • 0xTheC0der

#41

high

Claiming accumulated rewards while the contract is underfunded can lead to a loss of rewards

high

Position NFT can be spammed with insignificant positions by anyone until rewards DoS

Apr '23

EigenLayer Contest

EigenLayer Contest

13,081.9 USDC • 1 total finding • Code4rena • 0xTheC0der

gold

high

Slot and block number proofs not required for verification of withdrawal (multiple withdrawals possible)

ENS Contest

ENS Contest

59.79 USDC • Code4rena • 0xTheC0der

#20

Frankencoin

Frankencoin

22.6 USDC • Code4rena • 0xTheC0der

#66

Caviar Private Pools

Caviar Private Pools

37.62 USDC • 2 total findings • Code4rena • 0xTheC0der

#58

high

PrivatePool owner can steal all ERC20 and NFT from user via arbitrary execution

medium

`Factory.create`: Predictability of pool address creates multiple issues.

Rubicon v2

Rubicon v2

0.15 USDC • 1 total finding • Code4rena • 0xTheC0der

#125

high

Reward accounting is incorrect in BathBuddy contract

Feb '23

Ethos Reserve contest

Ethos Reserve contest

504.79 USDC • 1 total finding • Code4rena • 0xTheC0der

#23

medium

updateStrategyAllocBPS() can cause loss of ActivePool's collateral during an emergency exit