Banner
https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/822f7110-8137-4f70-a648-b4358e55fd2e.jpg

0xVolodya

Security Researcher

Smart contract security researcher, Ranked #1 on the 60-day leaderboard @code4rena Currently available for projects 🗓

Contact Me

High

14

Total

Medium

21

Total

$37.98K

Total Earnings

#227 All Time

22x

Payouts

silver

1x

2nd Places

bronze

1x

3rd Places

regular

10x

Top 10

All

Sherlock

Code4rena

Jul '24

MakerDAO Endgame

MakerDAO Endgame

2,776.56 USDC • Sherlock • 0xVolodya

#34

Jun '24

Mellow Modular LRTs

Mellow Modular LRTs

1,000 USDC • Sherlock • 0xVolodya

#6

Feb '24

Rio Network

Rio Network

1,000 USDC • Sherlock • 0xVolodya

#32

Napier

Napier

456.67 USDC • 1 total finding • Sherlock • 0xVolodya

#7

medium

tranche is not eip-5095 complaint

Jan '24

Arcadia

Arcadia

36.24 USDC • 1 total finding • Sherlock • 0xVolodya

#8

medium

reward tokens will be stuck in staking contract

Flat Money

Flat Money

603.02 USDC • 2 total findings • Sherlock • 0xVolodya

#12

high

User can announce several orders for the same position or steal partial funds from other user

high

liquidate module updates global state with a stale price.

Oct '23

NextGen

NextGen

10.97 USDC • 2 total findings • Code4rena • volodya

#95

high

Attacker can drain all ETH from AuctionDemo when block.timestamp == auctionEndTime

medium

Bidder Funds Can Become Unrecoverable Due to 1 second Overlap in `participateToAuction()` and `claimAuction()`

Aug '23

Dopex

Dopex

1,856.12 USDC • 5 total findings • Code4rena • volodya

#8

high

The settle feature will be broken if attacker arbitrarily transfer collateral tokens to the PerpetualAtlanticVaultLP

high

The peg stability module can be compromised by forcing lowerDepeg to revert.

high

Users can get immediate profit when deposit and redeem in `PerpetualAtlanticVaultLP`

medium

The owner of RPDX Decaying Bonds is not updated on token transfers

medium

The vault allows "free" swaps from WETH to RDPX

Tangible Caviar

Tangible Caviar

43.59 USDC • Code4rena • volodya

#64

Jul '23

Moonwell

Moonwell

2,487.26 USDC • 2 total findings • Code4rena • volodya

#7

medium

`fastTrackProposalExecution` doesn't check `intendedRecipient`

medium

Its not possible to liquidate deprecated market

Tokemak

Tokemak

4,281.99 USDC • 3 total findings • Sherlock • 0xVolodya

#7

high

Liquidations sometimes will not work due to incorrect logic inside queueNewRewards

high

Curve pool reentrancy check doesn't work for some pools which lead to draining of funds

high

Incentive Pricing will not provide a robust estimate of incentive pricing to the LMP due to incorrect scaling

PoolTogether

PoolTogether

2,014.75 USDC • 2 total findings • Code4rena • volodya

#9

medium

Number of prize tiers always increases if just 1 canary prize is claimed

medium

Inconsistent behavior for canary claims in claimer

May '23

Venus Protocol Isolated Pools

Venus Protocol Isolated Pools

6,224.32 USDC • 5 total findings • Code4rena • volodya

bronze

high

Incorrect `blocksPerYear` constant in `WhitepaperInterestRateModel`

medium

Exchange Rate can be manipulated

medium

Bad Debt in PoolLens.sol#getPoolBadDebt() is not calculated correctly in USD

medium

It's possible to borrow, redeem, transfer tokens and exit markets with outdated collateral prices and borrow interest

medium

Sometimes calculateBorrowerReward and calculateSupplierReward return incorrect results

Ajna Protocol

Ajna Protocol

606.99 USDC • 1 total finding • Code4rena • volodya

#18

high

User can avoid bankrupting by calling PositionManager.moveLiquidity where to index is bankrupted index

Apr '23

EigenLayer Contest

EigenLayer Contest

12,193.66 USDC • 2 total findings • Code4rena • volodya

silver

high

It is impossible to slash queued withdrawals that contain a malicious strategy due to a misplacement of the ++i increment

high

Slot and block number proofs not required for verification of withdrawal (multiple withdrawals possible)

Frankencoin

Frankencoin

22.67 USDC • 1 total finding • Code4rena • volodya

#65

medium

function `restructureCapTable()` in Equity.sol not functioning as expected

Rubicon v2

Rubicon v2

179.48 USDC • 4 total findings • Code4rena • volodya

#43

medium

Incorrect fee handling in Position.sol's Market Buy/Sell functions

medium

Potential infinite loop in `_borrowLimit` function

medium

Calling `Position._marketSell` function compares `fill_amt` that includes fee to `min_fill_amount` that does not include fee

medium

Calling `Position._marketBuy` and `Position._marketSell` functions that calculate `_fee` by dividing by `10000` can cause incorrect calculations

Mar '23

Asymmetry contest

Asymmetry contest

37.07 USDC • 2 total findings • Code4rena • volodya

#86

medium

DoS due to external call failure

medium

Missing derivative limit and deposit availability checks will revert the whole `stake()` function

Canto Identity Subprotocols contest

Canto Identity Subprotocols contest

1,992.82 USDC • 2 total findings • Code4rena • volodya

#4

high

Users will be able to purchase fewer NFTs than the project had anticipated

medium

Bio NFT incorrectly breaks SVG lines and doesn't support more than 120 characters effectively

Neo Tokyo contest

Neo Tokyo contest

19.3 USDC • Code4rena • volodya

#22

Wenwin contest

Wenwin contest

81.41 USDC • Code4rena • volodya

#24

Aragon Protocol contest

Aragon Protocol contest

53.96 USDC • Code4rena • volodya

#15