https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/87431a17-9bc5-4ee0-952d-866721733a0e.jpg

Vesko210

Security Researcher

Finding bugs If you're interested in an audit, reach out

Contact Me

High

Total

Medium

Total

$20.44K

Total Earnings

#441 All Time

20x

Payouts

1x

1st Places

2x

3rd Places

10x

Top 10

All

Sherlock

Code4rena

Cantina

CodeHawks

Apr '26

Monetrix

252.63 USDC • Code4rena • vesko210

Jan '26

Olas

336.64 USDC • 5 total findings • Code4rena • Valves

#26

high

UniswapPriceOracle.validatePrice() TWAP Calculation Flaw

high

Variable Overwrite in checkPoolAndGetCenterPrice() Creates Dead-Code Deviation Check, Leaving All V3 Protocol-Owned Liquidity Operations Unprotected

medium

Services can earn undeserved rewards by manipulating checkpoint timing during reward droughts

medium

Balancer oracle deadlock from cumulative price weight

medium

Uniswap oracle validateprice can be griefed per block via `sync()`

Flying Tulip

4,309.47 USDC • Sherlock • Valves

Dec '25

Panoptic: Next Core

9,260.89 USDC • 5 total findings • Code4rena • Valves

high

BuilderWallet `init()` is unprotected/re-initializable, enabling takeover and theft of builder fees

medium

Self-settlement via `dispatchFrom` bypasses refund mechanism allowing underfunded debt settlement

medium

Withdrawing just before a bad debt event can increase losses for remaining liquidity providers

medium

`dispatchFrom()` Liveness DoS via `StaleOracle`: Spot Price Manipulation Blocks Liquidations, Force Exercises, and Premium Settlements

medium

Commission Share-Burn Distribution is JIT-Capturable When `builderCode == 0` (Default)

Monolith Stablecoin Factory

1,691.10 USDC • 2 total findings • Sherlock • Valves

high

Borrower can extract unbacked Coin at the expense of the protocol

medium

A single borrower being written off will create unbacked stablecoins for all users

Nov '25

SukukFi

2,652.15 USDC • 3 total findings • Code4rena • Valves

high

Missing access control in `WERC7575Vault` allows unauthorized withdrawals

medium

The unregistering of vaults can be DoSed by a malicious user.

medium

Stale Redemption Liabilities Lead to Leveraged Losses for Remaining Shareholders and Potential Denial of Service

stNXM by EaseDeFi

4.51 USDC • 4 total findings • Sherlock • Vesko210

#36

medium

Missing slippage protection in Uniswap V3 liquidity operations

medium

Oracle `sanePrice` does not guard from manipulations after time has passed

medium

Missing tranche update in `extendDeposit` causes loss of stake tracking and rewards

medium

Duplicate tranche tracking

Megapot

0.13 USDC • 2 total findings • Code4rena • vesko210

#25

medium

Global Variable Manipulation During Active Draw Alters End Result

medium

Incorrect ticket price reference in JackpotBridgeManager causes user overpayment after price updates

Oct '25

Avon-Contracts

524.22 USDC • 5 total findings • Cantina • Valves

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

Sep '25

Summer.fi - governance v2

9.82 USDC • 1 total finding • Sherlock • Vesko210

medium

Small stakers can be unable to claim rewards due to an attack

Aug '25

USG - Tangent

6.43 USDC • 1 total finding • Sherlock • Vesko210

#62

medium

Frontrunning `processRewards` allows attacker to capture unintended rewards

Morpheus

6.61 USDC • 1 total finding • Code4rena • vesko210

#10

medium

Same heartbeat for multiple price feeds is vulnerable

Jul '25

pike-tapio-monrepo

130.34 USDC • 2 total findings • Cantina • vesko210

#18

medium

Finding not yet public.

medium

Finding not yet public.

succinct-network

249.3 USDC • 2 total findings • Cantina • vesko210

#27

medium

Finding not yet public.

medium

Finding not yet public.

May '25

ammalgam-contracts

114.56 USDC • 1 total finding • Cantina • vesko210

#18

high

Finding not yet public.

Audit 507

183.07 USDC • Code4rena • vesko210

#17

Apr '25

mighty-contracts

491.1 USDC • 4 total findings • Cantina • vesko210

#15

high

Finding not yet public.

high

Finding not yet public.

high

Finding not yet public.

high

Finding not yet public.

Feb '25

TermMax

211.47 USDC • Cantina • vesko210

Core Contracts

3.03 usdc • 4 total findings • CodeHawks • vesko2100

#321

high

Multiple Delegation by Double Spending Boosts and Lack of Delegation Tracking in BoostController Contract

medium

Flawed Boost Multiplier Calculation Always Yields Maximum Boost

low

Lack of enforcement of the `MAX_TOTAL_LOCKED_AMOUNT`

low

Overwriting Previous Allocations in allocateFunds May Lead to Loss of Cumulative Allocation Data

Dec '24

Flex Perpetuals

0.93 USDC • 1 total finding • Code4rena • vesko210

medium

Missing slippage protection in `AerodromeDexter.sol` `swapExactTokensForTokens()`