Banner
https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/43655f78-654f-4f70-87ae-bca00f3a837b.jpg

Bobai23

Security Researcher

....

Contact Me

High

4

Total

Medium

7

Total

$1.28K

Total Earnings

#1330 All Time

9x

Payouts

bronze

1x

3rd Places

regular

3x

Top 10

regular

4x

Top 25

All

Sherlock

Code4rena

CodeHawks

Nov '25

stNXM by EaseDeFi

stNXM by EaseDeFi

0.01 USDC • 1 total finding • Sherlock • Bobai23

#52

high

Malicious Owner Can Drain Vault More Faster than Malicious User Because Withdraw Delay can be set to 0

Privacy Cash

Privacy Cash

1.40 USDC • Sherlock • Bobai23

#68

Findings not publicly available for private contests.

Inverse Finance - Junior Tranche

Inverse Finance - Junior Tranche

12.54 USDC • 1 total finding • Sherlock • Bobai23

bronze

medium

`jDola.sol` violate ERC4626 compliant

Oct '25

Saffron Fixed Income Vaults

Saffron Fixed Income Vaults

0.00 USDC • Sherlock • Bobai23

#101

Sep '25

Super DCA Liquidity Network

Super DCA Liquidity Network

0.02 OP • 2 total findings • Sherlock • Bobai23

#50

high

Token Bucket Rewards Incorrectly Calculated

medium

Staker can Exploit Reward Accrual when `totalStakedAmount == 0`

BMX Deli Swap

BMX Deli Swap

676.05 USDC • 2 total findings • Sherlock • Bobai23

#6

high

Attacker manipulate Options using enable Auto voting system on Voter Contract

high

Potential DoS via Out-of-Gas in Auto-Voter Removal Process Leads to Permanent fund lock

Jul '25

Malda

Malda

496.09 USDC • 1 total finding • Sherlock • Bobai23

#21

medium

Complete Market DoS via Division by Zero in `utilizationRate()` Function When Reserves Exceed or Equal Available Cash

Mar '25

Nudge.xyz

Nudge.xyz

0.06 USDC • 1 total finding • Code4rena • Bobai23

#8

medium

Unauthorized Reallocation in `NudgeCampaign::handleReallocation` and Reward Disruption Vulnerability in `NudgeCampaign::invalidateParticipations`

Feb '25

Core Contracts

Core Contracts

99.30 usdc • 5 total findings • CodeHawks • bobai23

#141

medium

`MAX_TOTAL_SUPPLY` Bypass in `veRAACToken` via `increase()` Function

medium

Multiple Token Management Lets Withdraw a Token Different than Deposited Token

medium

Missing Predecessor Check in `executeEmergencyAction()` function

low

Unauthorized Vote Casting Vulnerability

low

Improper Handling of Predecessor Dependencies in Batch Scheduling and Execution