1nc0gn170

Security Researcher

Contact Me

High

Total

Medium

Total

$5.70K

Total Earnings

#712 All Time

21x

Payouts

1x

3rd Places

2x

Top 10

9x

Top 25

All

Sherlock

Code4rena

Cantina

CodeHawks

Feb '25

Rova

0.04 USDC • 1 total finding • Sherlock • 1nc0gn170

medium

Denial of Service Vulnerability in updateParticipation Due to Incorrect Comparision between TokenAmount & TokenCurrency

Jan '25

Aave v3.3

271.56 USDC • Sherlock • 1nc0gn170

#59

Oct '24

Avantis v1.5: Cross-Asset Leverage

325.29 OP • Sherlock • 1nc0gn170

#15

Findings not publicly available for private contests.

Sep '24

uniswap-v4

242.88 USDC • Cantina • 1nc0gn170

#53

Aug '24

Superposition

184.39 USDC • 4 total findings • Code4rena • Nikki

#21

high

Missing `lower<upper` check in `mint_position`

high

Unrevoked approvals allow NFT recovery by previous owner

high

update_emergency_council_7_D_0_C_1_C_58() updates nft manager instead of emergency council

medium

_onTransferReceived() does not work as intended

Jul '24

Basin

8.44 USDC • 1 total finding • Code4rena • Nikki

#11

high

Incorrectly assigned `decimal1` parameter upon decoding

Velocimeter

668.54 USDC • 5 total findings • Sherlock • 1nc0gn170

#12

high

An Attacker can DOS user withdrawal by delegating many tokens with least amount lock.

high

Incorrect `maxLockIdToIndex` value update in `disable_max_lock` creates unintended behaviour

high

Killing a Gauge Could Result in Stuck Funds

high

Incorrect Rewards distribution due to cached supply.

medium

First liquidity provider can DOS the pool of a stable pair

Jun '24

Vultisig

17.2 USDC • 2 total findings • Code4rena • Nikki

#26

high

Vultisig whitelisting can be bypassed by anyone

medium

Transfer of ILOPool NFT token to different account allows for users to bypass the pool's `maxCapPerUser` invariant

Apr '24

NOYA

0.18 USDC + NOYA stars • 1 total finding • Code4rena • Nikki

#121

medium

Incorrect modifier condition

Feb '24

curvance

328 USDC • 1 total finding • Cantina • 1nc0gn170

#37

high

Finding not yet public.

opal-contracts

519.37 USDC • 6 total findings • Cantina • 1nc0gn170

#19

high

Finding not yet public.

high

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

Jan '24

MorpheusAI

13.93 USDC • 2 total findings • CodeHawks • 1nc0gn170

#22

low

The `editPool()` lacks a sanity check on the `payoutStart` parameter leading to incorrect or unfair reward distributions

low

LayerZeroEndpoint.send() in L1Sender.sol may revert if the user does not provide enough native gas as specified

Decent

0.12 USDC • 1 total finding • Code4rena • Nikki

#55

high

Anyone can update the address of the Router in the DcntEth contract to any address they would like to set.

Curves

43.51 USDC • 3 total findings • Code4rena • Nikki

#66

high

Unauthorized Access to setCurves Function

medium

Curves::_buyCurvesToken(), Excess of Eth received is not refunded back to the user.

medium

Withdrawing with amount = 0 will forcefully set name and symbol to default and disable some functions for token subject

incentive-contracts

2,097.57 USDC • 7 total findings • Cantina • 1nc0gn170

#10

high

Finding not yet public.

high

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

Dec '23

The Standard

0.04 USDC • 1 total finding • CodeHawks • 1nc0gn170

#104

low

`costInEuros` calculation will incur precision loss due to division before multiplication

Aug '23

Dopex

650.79 USDC • 1 total finding • Code4rena • Nikki

#31

high

Put settlement can be anticipated and lead to user losses and bonding DoS

Jul '23

Beedle - Oracle free perpetual lending

177.65 USDC • 5 total findings • CodeHawks • 1nc0gn170

#23

high

[H-04] Lender#buyLoan - Malicious user could take over a loan for free without having a pool because of wrong access control

high

Stealing any loan opening for auction through others' lending pool

high

Attacker can steal a loan's collateral and break the protocol

high

A pool lender can fully drain another user's pool by abusing `buyLoan`

gas

Use assembly to perform hashing instead of Solidity to reduce gas costs.

Foundry DeFi Stablecoin CodeHawks Audit Contest

47.04 USDC • 1 total finding • CodeHawks • 1nc0gn170

#46

medium

Double-spending vulnerability leads to a disruption of the DSC token

CodeHawks Escrow Contract - Competition Details

59.72 USDC • 1 total finding • CodeHawks • 1nc0gn170

#42

gas

The arbiter should not be either the buyer or the seller.

Tokemak

47.41 USDC • 1 total finding • Sherlock • 1nc0gn170

#50

high

Transfer of Extra Tokens