0xfuje

Security Researcher

Contact Me

High

Solo

Total

Medium

Solo

Total

$42.53K

Total Earnings

#234 All Time

18x

Payouts

2x

1st Places

3x

2nd Places

12x

Top 10

All

Code4rena

Hats Finance

Sep '24

Circles

4,800 USDC • 1 total finding • Hats • 0xfuje

high

`personalMint()` reentrancy attack

Jun '24

Palmera

789.5 USDC • 1 total finding • Hats • 0xfuje

medium

Any contract can bypass `isSafe` restrictions

Intuition

400 USDC • Hats • 0xfuje

Inverter Network

6,900 UMA • Hats • 0xfuje

Mar '24

Most: Aleph Zero Bridge

2,000 USDT • 2 total findings • Hats • 0xfuje

low

Zero address & `bytes32` zero value checks for additional safety

low

Attacker can initialize `Most.sol` to set critical parameters

Feb '24

Wise Lending

1,800 USDC • Hats • 0xfuje

Paladin

8,900 PAL • Hats • 0xfuje

Nov '23

Possum Labs (Portals)

2,800 USDC • 3 total findings • Hats • 0xfuje

low

Approve on principal token can revert

low

Reward token can be unclaimable and stuck in an edge case

low

Quote functions return incorrect values during funding phase

ether.fi

1,400 USDC • Hats • 0xfuje

Oct '23

HATs Arbitration Contracts

5,700 USDC • 1 total finding • Hats • 0xfuje

high

Anyone can drain `HATArbitrator` via `refundExpiredSubmitClaimRequest()` with non-existing claims

SafeStaking by HOPR

3,500 HOPR • Hats • 0xfuje

SafeStaking (by HOPR)

1,600 DAI • Hats • 0xfuje

Sep '23

Maia DAO - Ulysses

25.79 USDC • 1 total finding • Code4rena • 0xfuje

#54

high

All tokens can be stolen from `VirtualAccount` due to missing access modifier

Centrifuge

296.01 USDC • 1 total finding • Code4rena • 0xfuje

#23

medium

Cached `DOMAIN_SEPARATOR` is incorrect for tranche tokens potentially breaking permit integrations

Jul '23

Tapioca DAO

830.86 USDC • 6 total findings • Code4rena • 0xfuje

#50

high

Potential 99.5% loss in `emergencyWithdraw()` of two Yieldbox strategies

high

[HB10] `AaveStrategy.sol`: Changing swapper breaks the contract

medium

CompoundStrategy `_currentBalance` uses `exchangeRateStored` which is leaks value

medium

`MagnetarV2#burst` double counts `msg.value` for `TOFT_WRAP` operation, making the transaction revert unless the user overpays

medium

Single UniswapV3Swapper using a single fee makes it highly likely to be suboptimal

medium

FullMath and TickMath libraries desire overflow behavior

Mar '23

Wenwin contest

21.7 USDC • Code4rena • 0xfuje

#26

Dec '22

Escher contest

31.16 USDC • Code4rena • 0xfuje

#57

Nov '22

Redacted Cartel contest

732.03 USDC • Code4rena • 0xfuje

#19