https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/defaults/default_avatar_8.png

AshishLac

Security Researcher

Web3 auditor | Lead specialist with 8+ yrs in Web2, Integrations & Marketing Automation | CS grad

Contact Me

High

5

Total

Medium

7

Total

$947.00

Total Earnings

#1398 All Time

8x

Payouts

bronze

1x

3rd Places

regular

2x

Top 10

regular

2x

Top 25

All

Sherlock

Code4rena

Cantina

CodeHawks

Jul '25

Allbridge Core Yield

Allbridge Core Yield

257.97 USDC • 1 total finding • Sherlock • AshishLac

bronze

medium

First Depositor Donation Attack Allows Profit Extraction

Jun '25

DODO Cross-Chain DEX

DODO Cross-Chain DEX

19.97 USDC • 2 total findings • Sherlock • AshishLac

#48

high

Due to Missing Validation of fromTokenAmount, User Can Inflate Target Token Output in GatewaySend.depositAndCall()

medium

GatewaySend.onRevert() function fails to handle native ETH refunds, User Funds Permanently Locked in GatewaySend

Apr '25

Burve

Burve

9.46 USDC • 1 total finding • Sherlock • AshishLac

#29

high

Users can imbalance the pool by removing a single pool token without paying tax due to incorrect calculation in removeValueSingle()

Mar '25

badger-ebtc-bsm

badger-ebtc-bsm

14.85 USDC • 1 total finding • Cantina • AshishLach

#31

high

Finding not yet public.

Feb '25

Liquidity Management

Liquidity Management

29.97 usdc • 1 total finding • CodeHawks • ashishlach

#50

medium

Functions that rely on chainlink prices cannot be queried on avalanche due to sequencer uptime check.

Dec '24

SecondSwap

SecondSwap

4.02 USDC • 3 total findings • Code4rena • AshishLach

#57

medium

Incorrect listing type validation bypasses enforcement of minimum purchase amount

medium

maxSellPercent can be buypassed by selling previously bought vestings at a later time

medium

Listing potential can not be purchased with discounted price

Oku's New Order Types Contract Contest

Oku's New Order Types Contract Contest

5.53 OP • 2 total findings • Sherlock • AshishLac

#32

high

cancelOrder() function can be used in Reentrancy attack

medium

safeApprove function is deprecated and is not recommended to be used as it could leads to revert in some cases

Nov '24

Project

Project

606.17 USDC • 1 total finding • CodeHawks • ashishlach

#7

high

MembershipERC1155 proxy cannot be upgraded