https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/9deaa57f-9bc0-4f32-bd2f-c5eb7ef36be2.png

Z-Bra

Security Researcher

High

5

Total

Medium

6

Total

$274.00

Total Earnings

#1666 All Time

9x

Payouts

bronze

1x

3rd Places

regular

2x

Top 10

regular

4x

Top 25

All

Sherlock

Code4rena

Cantina

CodeHawks

May '25

primev-validator-registry

primev-validator-registry

0.18 USDC • 1 total finding • Cantina • Z-Bra

#6

high

Finding not yet public.

stability-contracts

stability-contracts

243.06 USDC • 1 total finding • Cantina • Z-Bra

#14

high

Finding not yet public.

Apr '25

mighty-contracts

mighty-contracts

10.9 USDC • 1 total finding • Cantina • Z-Bra

#76

high

Finding not yet public.

Mar '25

PinLink: RWA-Tokenized DePIN Marketplace

PinLink: RWA-Tokenized DePIN Marketplace

0.01 USDC • Sherlock • Z-Bra

#101

Feb '25

Yieldoor

Yieldoor

0.09 USDC • 1 total finding • Sherlock • Z-Bra

#28

medium

Withdraw Calculation Bug in Leverager::Withdraw (Underflow & DoS)

Rova

Rova

0.04 USDC • 1 total finding • Sherlock • Z-Bra

bronze

medium

Launch::updateParticipation Misused Currency Amount And Token Amount

Core Contracts

Core Contracts

20.46 usdc • 5 total findings • CodeHawks • zebra

#243

high

Double Usage Index Scaling in StabilityPool Liquidation Inflates Required CRVUSD Balance

high

Hardcoded Exchange Rate Leading to Incorrect Deposits and Redemptions

medium

Treasury Contract Deposit Function Can Be Frontrun To Deny Protocol Operations

medium

Emergency revoke in RAACReleaseOrchestrator will freeze revoked RAAC tokens in orchestrator

low

Missing Pause Functionality in veRAACToken Contract Can Be Abused When Emergency Withdrawal Mechanism Is Activated

Jan '25

Liquid Ron

Liquid Ron

0 USDC • 1 total finding • Code4rena • Z-bra

#12

medium

Incorrect Logic in onlyOperator Modifier Leading to Denial-of-Service for Authorized Operators Across Critical Functions

daao-contracts

daao-contracts

0.23 USDC • 1 total finding • Cantina • Z-Bra

#122

medium

Finding not yet public.