https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/5642d001-7fcb-4a99-a34b-ba5e01be4dcc.png

ArsenLupin

Security Researcher

Smart contract security researcher ⚡️

Contact Me

High

11

Total

Medium

13

Total

$22.23K

Total Earnings

#334 All Time

8x

Payouts

gold

1x

1st Places

regular

4x

Top 10

regular

5x

Top 25

All

Sherlock

Code4rena

Cantina

CodeHawks

Jan '25

ton-pool-contracts

ton-pool-contracts

8,825.8 USDC • 2 total findings • Cantina • ArsenLupin

gold

high

Finding not yet public.

medium

Finding not yet public.

Jul '24

TraitForge

TraitForge

0.01 USDC • 4 total findings • Code4rena • ArsenLupin

#88

high

`mintToken()`, `mintWithBudget()`, and `forge()` in the `TraitForgeNft` Contract Will Fail Due to a Wrong Modifier Used in `EntropyGenerator.initializeAlphaIndices()`

high

Wrong minting logic based on total token count across generations

medium

Pause and unpause functions are inaccessible

medium

Discrepancy between nfts minted, price of nft when a generation changes & position of `_incrementGeneration()` inside `_mintInternal()` & `_mintNewEntity()`

CCIP v1.5

CCIP v1.5

10,057.47 USDC • CodeHawks • arsenlupin

#8

May '24

Olas

Olas

1,602.32 USDC • 3 total findings • Code4rena • ArsenLupin

#7

medium

Attacker can cancel claimed staking incentives on Arbitrum

medium

Blocklisted or paused state in staking token can prevent service owner from unstaking

medium

StakingToken.sol doesn't properly handle FOT, rebasing tokens or those with variable which will lead to accounting issues downstream.

Apr '24

NOYA

NOYA

935.18 USDC + NOYA stars • 9 total findings • Code4rena • ArsenLupin

#17

high

`SNXConnector.sol` TVL calculation is incorrect.

high

`PendleConnector` incorrectly sends the redeemed `PT` tokens to the market instead of the

high

`executeWithdraw` may be blocked if any of the users are blacklisted from the `baseToken`

high

SiloConnector `_getPositionTVL` miscalculate the TVL position

medium

Chainlink connector doesn’t check for the Min / Max prices returned

medium

Balancer flashloan contract can be DOSed completely by sending 1 wei to it

medium

The health factor check in `PrismaConnector::adjustTrove` will always pass because the ICR in the Primsma protocol has 20 decimals

medium

Using the same heartbeat for multiple price feeds

medium

Dust donation might DOS all connectors to create new holding positions, by preventing removing existing holding positions

TITLES Publishing Protocol

TITLES Publishing Protocol

414.03 USDC • 4 total findings • Sherlock • ArsenLupin

#9

high

The attacker could mint all the tokenId's, but paying the fee only for the 1 tokenId

high

During the collectMintFee the collection referrer doesn't receive any fees.

medium

The mintBatch function works incorrectly, which could case the revert or the Edition.sol being drained.

medium

createEdition function will not work correctly on the zkSync, preventing from the correct address deployment

Mar '24

Revert Lend

Revert Lend

398.02 USDC • 1 total finding • Code4rena • ArsenLupin

#32

high

`V3Vault.sol` permit signature does not check receiving token address is USDC

Jan '24

Curves

Curves

0 USDC • 1 total finding • Code4rena • ArsenLupin

#137

high

Unauthorized Access to setCurves Function