https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/468a3e79-c6a7-4d70-bbff-09877316591c.jpg

FonDevs

Security Researcher

Web3 Security Sleuth 💻

Contact Me

High

6

Total

Medium

6

Total

$7.27K

Total Earnings

#727 All Time

13x

Payouts

bronze

2x

3rd Places

regular

4x

Top 10

regular

5x

Top 25

All

Sherlock

Code4rena

CodeHawks

Sep '25

Super DCA Liquidity Network

Super DCA Liquidity Network

0.00 OP • 1 total finding • Sherlock • FonDevs

#52

high

staking or unstaking before SuperDCAStaking::accrueReward is called will cause rewards tokens not to be minted

Dec '24

Alchemix Transmuter

Alchemix Transmuter

0.00 op • 1 total finding • CodeHawks • fondevs

#31

low

Old router retains token allowance after update

SecondSwap

SecondSwap

2.81 USDC • 1 total finding • Code4rena • Fon

#60

medium

Rounding error in stepDuration calculations.

Chainlink Payment Abstraction

Chainlink Payment Abstraction

1,987.07 USDC • Code4rena • Fon

bronze
Lambo.win

Lambo.win

0.3 USDC • 2 total findings • Code4rena • Fon

#35

high

Minting zero tokens when underlyingToken is not Ether in cashIn()

medium

Since the cost of launching a new pool is minimal, an attacker can maliciously consume VirtualTokens.

Nov '24

Nouns DAO - Auction Streams

Nouns DAO - Auction Streams

27.28 USDC • Sherlock • FonDevs

#47

Oct '24

AXION

AXION

111.80 USDC • 1 total finding • Sherlock • FonDevs

#10

medium

wrong use of `initializer` modifier in `MasterAMO.sol` will cause `V2AMO.sol` and `V3AMO.sol` to revert when the `function initialize` is called

Jul '24

Munchables

Munchables

0.39 USDC • 1 total finding • Code4rena • Fon

#48

high

Single plot can be occupied by multiple renters

Biconomy: Nexus

Biconomy: Nexus

226.45 USDC • 1 total finding • CodeHawks • fondevs

#13

medium

Typehash for ModuleEnableMode struct is incorrect

Feb '24

Smilee Finance

Smilee Finance

92.26 USDC • 1 total finding • Sherlock • FonDevs

#8

medium

`IG.sol` mint and burn functions are vulnerable to DOS attack

Dec '23

stake.link

stake.link

4,784.63 USDC • 3 total findings • CodeHawks • fondevs

bronze

high

Not Update Rewards in `handleIncomingUpdate` Function of `SDLPoolPrimary` Leads to Incorrect Reward Calculations

medium

Attacker can exploit lock update logic on secondary chains to increase the amount of rewards sent to a specific secondary chain

low

Insufficient Gas Limit Specification for Cross-Chain Transfers in _buildCCIPMessage() method. WrappedTokenBridge.sol #210

Jul '23

Beedle - Oracle free perpetual lending

Beedle - Oracle free perpetual lending

14.27 USDC • 5 total findings • CodeHawks • fondevs

#140

high

Lender contract can be drained by re-entrancy in `setPool`

low

Zero address leads to transaction reverts

gas

Use of magic numbers

gas

For the borrow(), repay() & startAuction() functions in Lender.sol the public visibility modifiers should be changed to external, to help optimize gas usage

gas

Don't initialize `uint/int` variables with default value

Jan '23

Biconomy - Smart Contract Wallet contest

Biconomy - Smart Contract Wallet contest

22.72 USDC • 1 total finding • Code4rena • Fon

#57

high

Arbitrary transactions possible due to insufficient signature validation