https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/defaults/default_avatar_3.png

8olidity

Security Researcher

Contact Me

High

12

Total

Medium

28

Total

$5.41K

Total Earnings

#875 All Time

24x

Payouts

regular

8x

Top 10

regular

13x

Top 25

regular

22x

Top 50

All

Sherlock

Mar '26

Current Finance

Current Finance

0.25 USDC • 3 total findings • Sherlock • 8olidity

#27

high

Liquidation seize calculation uses spot price without EMA consistency check

medium

Debt ADL Uses Group-Scoped Config but Global Debt Trigger

medium

Deposit limit check double subtracts protocol reserves, allowing cap bypass

Oct '25

Index Fun Order Book

Index Fun Order Book

114.68 USDC • 3 total findings • Sherlock • 8olidity

#6

medium

Zero-Cost Settlement via Payment Rounding

medium

Fee Custody Hijack by Authorized Matchers

medium

Emergency Resolution Skips Past Epochs

Sep '25

Super DCA Liquidity Network

Super DCA Liquidity Network

232.31 OP • 3 total findings • Sherlock • 8olidity

#16

high

Stake/Unstake Reward Wipe

high

Cross-Pool Reward Siphoning

medium

Zero-Stake Infinite Emissions

Summer.fi - governance v2

Summer.fi - governance v2

381.18 USDC • 1 total finding • Sherlock • 8olidity

#5

medium

Vesting Factory Owner Can Recall Tokens While Escrow Owns Wallet

Ammplify

Ammplify

27.60 USDC • 4 total findings • Sherlock • 8olidity

#63

medium

Unrestricted Maker Gifting Bricks Victim Accounts

medium

NFT Metadata Reader Hits Diamond Storage Mismatch

medium

Decompose Underflow Bricks Small Positions

medium

Vault Balance Transfer Hard-Reverts

Aug '25

USG - Tangent

USG - Tangent

37.97 USDC • 1 total finding • Sherlock • 8olidity

#56

medium

wStable Contract is Vulnerable to ERC4626 Inflation Attack

Jul '25

Malda

Malda

41.41 USDC • 2 total findings • Sherlock • 8olidity

#39

medium

Flawed logic in `Rebalancer.sendMsg` for the `maxTransferSize` check can cause a Denial of Service, blocking the rebalancing mechanism after a time window resets.

medium

Blacklisted users can withdraw funds from mTokenGateway by using a non-blacklisted delegated account.

Mellow Flexible Vaults

Mellow Flexible Vaults

7.06 USDC • 2 total findings • Sherlock • 8olidity

#38

high

Signature Re-use Bypasses Multi-signature Threshold in Consensus Module

medium

Incorrect Index Usage in `DepositQueue.cancelDepositRequest` Leads to Accounting Corruption and Permanent Denial-of-Service

May '23

Footium

Footium

0.01 USDC • 1 total finding • Sherlock • 8olidity

#32

medium

Use safeTransfer/safeTransferFrom consistently instead of transfer/transferFrom

Apr '23

Teller

Teller

196.24 USDC • 3 total findings • Sherlock • 8olidity

#26

high

`setCollateralEscrowBeacon()` can be called by anyone

high

`commitCollateral()` can be called by anyone

medium

fee-on-transfer tokens are not supported

Mar '23

Gitcoin

Gitcoin

80.82 USDC • Sherlock • 8olidity

#38

Taurus

Taurus

30.89 USDC • 1 total finding • Sherlock • 8olidity

#12

medium

Logic Error in _decreaseCurrentMinted

Feb '23

Syndr

Syndr

798.15 USDC • Sherlock • 8olidity

#6

Findings not publicly available for private contests.

Blueberry

Blueberry

557.46 USDC • 3 total findings • Sherlock • 8olidity

#18

high

The attacker can bypass the original logic of `reduceposition()`

medium

No check sequencer is down in Chainlink feeds

medium

`latestRoundData()` has no check for round completeness

OpenQ

OpenQ

236.36 USDC • 2 total findings • Sherlock • 8olidity

#26

high

DepositManagerV1::refundDeposit() does not judge bounty status

high

claimManager will cause BountyCore::refundDeposit() to fail

Jan '23

Cooler

Cooler

0.30 USDC • 1 total finding • Sherlock • 8olidity

#30

high

use safetransfer and safetransferFrom

Nov '22

Isomorph

Isomorph

135.21 USDC • 1 total finding • Sherlock • 8olidity

#21

medium

Price oracle could get a stale price

DODO

DODO

62.49 USDC • 1 total finding • Sherlock • 8olidity

#6

medium

`address.call{value:x}()` should be used instead of `payable.transfer()`

Bond Protocol

Bond Protocol

1,604.26 USDC • 2 total findings • Sherlock • 8olidity

#5

medium

Solmate safetransfer and safetransferfrom doesnot check the codesize of the token address, which may lead to fund loss

medium

The value of `createFeeDiscount` can never be updated

Sense

Sense

99.23 USDC • 1 total finding • Sherlock • 8olidity

#7

medium

rollerPeriphery::approve() has no permission control and can steal contract tokens

Oct '22

Astaria

Astaria

65.78 USDC • 1 total finding • Sherlock • 8olidity

#27

high

As long as the set `Feeto` address, will make `VaultImplementation.sol::commitToLien()` to stop working

NFTPort

NFTPort

176.00 USDC • 1 total finding • Sherlock • 8olidity

#9

medium

Nonces not used in signed data

Union Finance

Union Finance

317.74 USDC • 1 total finding • Sherlock • 8olidity

#16

medium

use safecast

Mycelium

Mycelium

209.05 USDC • 2 total findings • Sherlock • 8olidity

#7

high

Steal their money

medium

ConvertToShares () uses the LINK of the contract to calculate and may result in a loss of user assets