https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/defaults/default_avatar_6.png

Dug

Security Researcher

Contact Me

High

25

Total

Medium

1

Solo

19

Total

$13.14K

Total Earnings

#456 All Time

22x

Payouts

bronze

2x

3rd Places

regular

7x

Top 10

regular

12x

Top 25

All

Sherlock

Code4rena

Jul '23

GFX Labs

GFX Labs

2,240.76 USDC • 2 total findings • Sherlock • Dug

bronze

high

Owner can steal funds via malicious `fastGasFeed` contract

high

Protocol is unable to support any pools that include wrapped native tokens

Jun '23

Unstoppable

Unstoppable

1,088.51 USDC • 3 total findings • Sherlock • Dug

#7

high

`Vault::reduce-position` results in a loss of funds

high

`Vault` debt interest is never accrued

medium

`MarginDex::execute_limit_order` will always revert

Unitas Protocol

Unitas Protocol

1,409.13 USDC • 1 total finding • Sherlock • Dug

#8

high

Price updates vulerable to sandwitch attacks

May '23

Chainlink Cross-Chain Services: CCIP and ARM Network

Chainlink Cross-Chain Services: CCIP and ARM Network

201.79 USDC • Code4rena • Dug

#40

Eco Protocol

Eco Protocol

528.73 USDC • 1 total finding • Sherlock • Dug

#6

high

After L1 ECO token inflation but before a rebase, gons are incorrectly calculated when initiating deposits and finalizing withdrawals

USSD - Autonomous Secure Dollar

USSD - Autonomous Secure Dollar

31.53 USDC • 7 total findings • Sherlock • Dug

#51

high

Incorrect price feed used in `StableOracleWBTC`

high

The price from `StableOracleDAI` is returned with the incorrect number of decimals

high

Underlying collateral can be drained from the protocol

high

There is no slippage protection when swapping tokens

medium

Lack of validation for Chainlink price feed timestamps allow outdated prices to be used

medium

At certain DAI collateral balances `BuyUSSDSellCollateral` will revert

medium

Removing collateral type makes the protocol insolvent

Ajna Protocol

Ajna Protocol

326.09 USDC • 3 total findings • Code4rena • Dug

#27

high

Claiming accumulated rewards while the contract is underfunded can lead to a loss of rewards

high

Delegation rewards are not counted toward granting fund

medium

Governance attack on Extraordinary Proposals

Footium

Footium

714.04 USDC • 4 total findings • Sherlock • Dug

bronze

high

When a club is sold, the buyer can be rugged

medium

Footium clubs can be minted to contracts that do not support ERC-721

medium

Certain ERC-20 tokens will become locked within escrow contracts

medium

Changes to `FootiumAcademy._maxGenerationId` affects past seasons

Apr '23

EigenLayer Contest

EigenLayer Contest

528.25 USDC • Code4rena • Dug

#20

Teller

Teller

185.43 USDC • 2 total findings • Sherlock • Dug

#29

high

Missing access control for `CollateralManager.setCollateralEscrowBeacon()` allows for collateral to be stolen

medium

A lender can frontrun a payment on a defaulted loan, taking both collateral and repayment

Caviar Private Pools

Caviar Private Pools

20.19 USDC • 2 total findings • Code4rena • Dug

#66

medium

`Factory.create`: Predictability of pool address creates multiple issues.

medium

Royalty recipients will not get fair share of royalties

Rubicon v2

Rubicon v2

0.44 USDC • 2 total findings • Code4rena • Dug

#122

high

Reward accounting is incorrect in BathBuddy contract

medium

Calling `ExpiringMarket.stop` and `ExpiringMarket.isClosed` functions cannot pause any functionlities of the market

Mar '23

Gitcoin

Gitcoin

247.06 USDC • Sherlock • Dug

#16

Asymmetry contest

Asymmetry contest

16.76 USDC • 2 total findings • Code4rena • Dug

#106

high

An attacker can manipulate the preDepositvePrice to steal from other users.

high

Staking, unstaking and rebalanceToWeight can be sandwiched (Mainly rETH deposit )

Y2K

Y2K

1,326.02 USDC • 6 total findings • Sherlock • Dug

#12

high

Deposit fee can be bypassed

high

Updating a queued rollover corrupts rollover accounting

high

Delisting a rollover can prevent minting of other queued rollovers

medium

`changeTreasury` does not set vault treasuries correctly

medium

A new controller could be unable to resolve epochs

medium

If a pegged token oracle goes down or price falls to zero, depeg events cannot be triggered

Neo Tokyo contest

Neo Tokyo contest

2,849.36 USDC • 1 total finding • Code4rena • Dug

#6

high

Updating a pool's total points doesn't affect existing stake positions for rewards calculation

Wenwin contest

Wenwin contest

148.64 USDC • 1 total finding • Code4rena • Dug

#22

medium

The buyer of the ticket could be front-runned by the ticket owner who claims the rewards before the ticket's NFT is traded

Feb '23

Surge

Surge

33.02 USDC • 2 total findings • Sherlock • Dug

#18

medium

Pool shares can be sent to the zero address as fees

medium

Token approval can be front-run

Hats

Hats

1,011.97 USDC • 3 total findings • Sherlock • Dug

#6

high

Safe threshold set incorrectly by `reconcileSignerCount`

high

`maxSigners` can be exceeded, causing all safe transactions to revert

medium

Valid signers can be forcibly removed from the safe

OlympusDAO

OlympusDAO

114.76 USDC • 1 total finding • Sherlock • Dug

#28

high

Every withdrawal caches rewards, allowing them to be claimed multiple times

Blueberry

Blueberry

103.09 USDC • 1 total finding • Sherlock • Dug

#30

high

ICHI Vault LP tokens cannot be withdrawn

Jan '23

RabbitHole Quest Protocol contest

RabbitHole Quest Protocol contest

11.33 USDC • Code4rena • Dug

#77