NHristov

Security Researcher

Contact Me

High

Total

Medium

Total

$14.16K

Total Earnings

#504 All Time

12x

Payouts

2x

1st Places

7x

Top 10

8x

Top 25

All

Sherlock

Code4rena

CodeHawks

Immunefi

Sep '25

Super DCA Liquidity Network

1.12 OP • 2 total findings • Sherlock • NHristov

#48

high

Any user can nullify a bucket’s pending emissions by dust staking/unstaking, starving stakers of rewards

medium

Changing `mintRate` retroactively rewrites past emissions because `setMintRate` doesn’t accrue pending index first

Aug '25

Neutrl Protocol

941.02 USDC • 1 total finding • Sherlock • NHristov

medium

Fully restricted staker will bypass staking and transfer restrictions for `sNUSD`

Jul '25

Oku Trade Order Types

2,625 USDC • 1 total finding • Sherlock • NHristov

medium

Precision loss allows a mallicious user to drain amount received from orders

Audit Comp | Folks Smart Contract Library

1,308 USDC • 1 total finding • Immunefi • NHristov

#10

medium

Finding not yet public.

May '25

Audit Comp | Flare | FAssets

8,155 • 2 total findings • Immunefi • NHristov

high

Finding not yet public.

medium

Finding not yet public.

Mar '25

Audit Comp | Yeet

274 USDC • 1 total finding • Immunefi • NHristov

medium

Finding not yet public.

Feb '25

THORWallet

0 USDC • 1 total finding • Code4rena • NHristov

#10

medium

Improper Transfer Restrictions on Non-Bridged Tokens Due to Boolean Bridged Token Tracking, Allowing a DoS Attack Vector

Virtuals Protocol

648.29 USDC • 2 total findings • Code4rena • NHristov

#12

medium

If `FFactory::buyTax` and / or `FFactory::sellTax` is set to 0, buy / sell would revert

medium

Missing Slippage Protection On Buy And Sell

Core Contracts

12.96 usdc • 8 total findings • CodeHawks • nikolaihristov1999

#265

high

`BaseGauge` users can claim rewards without staking

high

Users Can Overwrite Existing Locks in veRAACToken Resulting in Permanent Loss of Funds

high

Multiple issues from unnecessary balance increase calculation in DebtToken.mint

high

RToken's transfer function lead to loss of funds due to incorrect math

high

Attackers can get most of RAACToken rewards by withdrawing dust amount from StabilityPool multiple times

medium

Incorrect DebtToken totalSupply Scaling Breaks Interest Rate Calculations

medium

LendingPool deposits do not work with CurveVault due to lack of funds

medium

Users Can Lose Funds and Collateral by Repaying Loans After Liquidation Grace Period Expiry

Jan '25

Audit Comp | Butter

191 USDC • 2 total findings • Immunefi • NHristov

low

Finding not yet public.

low

Finding not yet public.

Dec '24

Alchemix Transmuter

0.00 op • 1 total finding • CodeHawks • nikolaihristov1999

#31

low

Old router retains token allowance after update

SecondSwap

0 USDC • 1 total finding • Code4rena • NHristov

#67

high

Users can claim more that their actual allotment