https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/551af4af-e4be-40a7-a676-4b3f05293c07.jpg

JohnWeb3

Security Researcher

Security Researcher. Portfolio: https://github.com/johnyfwesh

Contact Me

High

Total

Medium

Total

$17.11K

Total Earnings

#478 All Time

22x

Payouts

1x

2nd Places

3x

Top 10

11x

Top 25

All

Sherlock

Code4rena

Cantina

Immunefi

Apr '26

Clear Macro by Superfluid

0.72 USDC • Sherlock • JohnWeb3

#128

Mar '26

Revert Finance

154.42 USDC • 1 total finding • Cantina • johnyfwesh

#14

medium

Finding not yet public.

Audit Comp | Folks Finance: Staking Contracts

340 USDC • 1 total finding • Immunefi • Johnyfwesh

#29

medium

Finding not yet public.

Current Finance

17.26 USDC • 2 total findings • Sherlock • JohnWeb3

#22

medium

Debt ADL threshold uses reserve-wide debt instead of the configured EMode-group borrow

medium

Rate-limit capacity can be grief-burned across segment boundaries because inflow reductions only touch the current segment

Jan '26

Olas

14.33 USDC • 1 total finding • Code4rena • johnyfwesh

#53

medium

Arbitrum Retryable-Ticket Refund/Value Not Verified Enables Timelock ETH Exfiltration

OpenCover Insured Vaults

0.23 USDC • Sherlock • JohnWeb3

#140

VII-Finance-Contracts

37.32 OP • 1 total finding • Cantina • johnyfwesh

#26

high

Finding not yet public.

Flying Tulip

1.24 USDC • Sherlock • JohnWeb3

#209

Dec '25

Panoptic: Next Core

1,050.92 USDC • 2 total findings • Code4rena • johnyfwesh

#12

high

BuilderWallet `init()` is unprotected/re-initializable, enabling takeover and theft of builder fees

high

Cross-contract reentrancy in liquidation enables conversion of phantom shares to real shares, draining CollateralTracker assets

Rujira

0 USDC • 5 total findings • Code4rena • johnyfwesh

#53

high

Finding not yet public.

high

Finding not yet public.

high

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

Monolith Stablecoin Factory

5.20 USDC • 1 total finding • Sherlock • JohnWeb3

#25

medium

`InterestModel.calculateInterest()` can divide by zero when `wadExp()` underflows to 0, causing persistent interest-accrual failure

Nov '25

SukukFi

0 USDC • 1 total finding • Code4rena • johnyfwesh

high

Missing access control in `WERC7575Vault` allows unauthorized withdrawals

Swafe

4,454.56 USDC • 2 total findings • Code4rena • johnyfwesh

medium

Majority consensus threshold not enforced for even number of nodes

medium

Unbounded associations per account make recovery initiation linear-time

Audit Comp | Vechain | Stargate Hayabusa

14 USDT • 1 total finding • Immunefi • Johnyfwesh

#47

high

Finding not yet public.

Oct '25

Reflector V3

0.33 USDC • 3 total findings • Code4rena • johnyfwesh

#14

high

`set_invocation_costs_config()` fails to authorize admin allowing anyone to set invocation costs

medium

Systematic Overcharge in prices and x_prices: Fee Charged for Requested Records While Return is Capped at 20

medium

`twap()` under-charges for multi-period queries due to hardcoded `periods=1`

Audit Comp | Alchemix V3

0 USDC • 1 total finding • Immunefi • Johnyfwesh

#159

medium

Finding not yet public.

Sequence

40.59 USDC • 1 total finding • Code4rena • johnyfwesh

#11

medium

Session signatures replay across wallets due to missing wallet binding

Avon-Contracts

355.68 USDC • 3 total findings • Cantina • johnyfwesh

#11

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

Sep '25

Super DCA Liquidity Network

5.61 OP • 2 total findings • Sherlock • JohnWeb3

#44

high

Fee collection DoS on native currency pools

high

Bucket reward wipe via stake/unstake index reset

Monad

5,552.08 USDC • 1 total finding • Code4rena • johnyfwesh

#13

medium

Remote process crash (OOM) via post‑serialization size check and large batch aggregation in JSON‑RPC

Succinct

5,000.28 USDC • 1 total finding • Code4rena • johnyfwesh

medium

Zero Config Values Can Crash or Stall the Prover Indefinitely

Aug '25

GTE Perps and Launchpad

70.72 USDC • 2 total findings • Code4rena • johnyfwesh

#75

high

Total reward shares for token can reach zero after unlocking, causing `GTELaunchpadV2Pair` to be bricked

medium

Price Accumulators Overflow in GTELaunchpadV2Pair contract Causes AMM-wide DoS