X0sauce

Security Researcher

Contact Me

High

Total

Medium

Total

$2.32K

Total Earnings

#950 All Time

11x

Payouts

2x

1st Places

1x

2nd Places

4x

Top 10

All

Sherlock

Code4rena

Mar '25

Symmio, Staking and Vesting

8.90 USDC • 2 total findings • Sherlock • X0sauce

#16

medium

Reward distribution can be indefinitely extended by supplying small amounts of reward token

medium

Vesting plans cannot be resetted upon new addition of SYMM LP tokens

Feb '25

Rova

1,178.30 USDC • 2 total findings • Sherlock • X0sauce

medium

Minimum and maximum token amount allowed for user is wrongly compared in `updateParticipation`

medium

Token allocation is wrongly updated in `updateParticipation`

Jan '25

Plaza Finance

92.87 USDC • 6 total findings • Sherlock • X0sauce

#37

high

`Pool.transferReserveToAuction` does not correctly reduce `currentPeriod` to transfer `reserveTokens` to Auction

medium

Precision difference in `getRedeemAmount` results in inaccurate marketRate and redeemRate compairison

medium

Precision loss in `getCreateAmount` and `getRedeemAmount` functions

medium

Inconsistency in `sharesPerToken` values recorded

medium

Excess bids cannot be removed in `Auction.removeExcessBids` if address is USDC blacklisted

medium

Unspent deposit amount is stuck in `BalancerRouter` and not returned to depositor

Dec '24

SecondSwap

0.83 USDC • 1 total finding • Code4rena • X0sauce

#63

medium

Listing potential can not be purchased with discounted price

Oku's New Order Types Contract Contest

0.01 OP • 1 total finding • Sherlock • X0sauce

#65

medium

The `PythOracle.currentValue` function always returns outdated prices

Lambo.win

0 USDC • 1 total finding • Code4rena • X0sauce

#36

high

Minting zero tokens when underlyingToken is not Ether in cashIn()

Nov '24

Ethos Network Financial Contracts

0.38 USDC • 1 total finding • Sherlock • X0sauce

#33

high

Market funds cannot be withdrawn for a profile as fees are not subtracted from `fundsPaid` when they are already applied

Nouns DAO - Auction Streams

137.02 USDC • Sherlock • X0sauce

#23

vVv Launchpad - Investments & Token distribution

94.59 USDC • 1 total finding • Sherlock • X0sauce

high

`VVVVCTokenDistributor.claim` can be front-run to steal rewards

Telcoin Update #2

491.86 USDC • Sherlock • X0sauce

Oct '24

Gamma Brevis Rewarder

314.34 OP • 1 total finding • Sherlock • X0sauce

medium

[M-01] Distribution created with very small amount results in lost in fees for fee recipient and distribution assets for hypervisors