https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/e53685f9-49e7-4277-bd50-400bb2e09f21.jpg

Ziusz

Bounty Hunter

SEE YOU SPACE COWBOY...

Contact Me

High

Total

Medium

Total

$9.00K

Total Earnings

#637 All Time

13x

Payouts

1x

1st Places

1x

2nd Places

5x

Top 10

All

Sherlock

Code4rena

Cantina

Sep '25

Ammplify

51.21 USDC • 3 total findings • Sherlock • Ziusz

#51

high

Missing canonical Uniswap V3 pool verification allows arbitrary token theft from the diamond via malicious pool

medium

ViewWalker misroutes unpaid X to Y breaking `queryAssetBalances` correctness

medium

NFTManager `burnAsset` always triggers JIT penalty on removal

Aug '25

USG - Tangent

2.34 USDC • 1 total finding • Sherlock • Ziusz

#64

high

Attacker can spoof ControlTower in migrateFrom to steal user collateral

Neutrl Protocol

941.02 USDC • 1 total finding • Sherlock • Ziusz

medium

FULL_RESTRICTED user can bypass staking restriction by depositing to different receiver

Yield Basis

69.47 USDC • 1 total finding • Sherlock • Ziusz

#10

medium

Factory gauge controller can only be set to zero address due to assert logic error

Jul '25

Malda

1,035.54 USDC • 6 total findings • Sherlock • Ziusz

#13

high

Rebalancer can steal all funds through EverclearBridge

medium

MixedPriceOracleV4 decimal mismatch breaks oracle redundancy system

medium

`WrapAndSupply` fails to forward ETH for gas fees breaking the cross-chain functionality

medium

Blacklisted users can withdraw funds via delegates bypassing blacklist enforcement

medium

DoS on window rollover can block liquidity rebalancing

medium

EverclearBridge never pulls tokens from Rebalancer causing complete rebalancing DoS

USDaf-v2

1,250 USDC • Cantina • Ziusz

Jun '25

Symbiotic Relay

2,569.06 USDC • 3 total findings • Sherlock • Ziusz

medium

Unbounded loop in PersistentSet allows any user to cause permanent DoS on core view functions

medium

Unregistered operators retain voting power through registered vaults causing inconsistent state

medium

State Inconsistency in OperatorsWhitelist allows bypassing access control

DODO Cross-Chain DEX

0.20 USDC • 1 total finding • Sherlock • Ziusz

#73

high

Flawed authorization logic in `claimRefund` allows theft of non-EVM refunds

May '25

LEND

9.60 USDC • 3 total findings • Sherlock • Ziusz

#87

high

System will prevent valid Cross-Chain Liquidations due to Irrelevant Check in `_checkLiquidationValid`

high

System will understate liabilities for Borrowers leading to Protocol Insolvency by bad condition in `borrowWithIntest`

high

Incorrect LToken Accounting in `CoreRouter.supply()` can lead to discrepancy in User's favor

aera-v3

1,289.75 USDC • 1 total finding • Cantina • Ziusz

high

Finding not yet public.

Audit 507

56.02 USDC • Code4rena • Ziusz

#25

jigsaw-contracts

67.91 USDC • 1 total finding • Cantina • Ziusz

#56

high

Finding not yet public.

Apr '25

Burve

1,657.16 USDC • 1 total finding • Sherlock • Ziusz

#12

high

User can drain value from Protocol/LPs by receiving excess shares during swaps into appreciating ERC4626 vaults