https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/defaults/default_avatar_4.png

axelot

Security Researcher

Contact Me

High

5

Total

Medium

12

Total

$8.78K

Total Earnings

#657 All Time

11x

Payouts

regular

3x

Top 10

regular

7x

Top 25

regular

10x

Top 50

All

Sherlock

Oct '25

Index Fun Order Book

Index Fun Order Book

721.30 USDC • 2 total findings • Sherlock • axelot

#4

medium

EIP-1155 is broken in `PositionTokens`

medium

Privilege escalation of authorized matchers, who can divert fees and pause trading

3Jane

3Jane

1,955.18 USDC • Sherlock • axelot

#6

Findings not publicly available for private contests.

Sep '25

Super DCA Liquidity Network

Super DCA Liquidity Network

0.02 OP • 2 total findings • Sherlock • axelot

#50

high

Any user can delete pending bucket emissions by staking/unstaking before donations

medium

Any staker will mint past-idle emissions to their chosen bucket, drifting emissions and violating expected timing invariant

Dango DEX

Dango DEX

4,480.27 USDC • 1 total finding • Sherlock • axelot

#5

high

Unbalanced deposit fee under-charges large asymmetries, stealing from LPs

BMX Deli Swap

BMX Deli Swap

198.80 USDC • 1 total finding • Sherlock • axelot

#13

high

Retroactive auto-voting for epochs that already ended is possible.

Ammplify

Ammplify

283.33 USDC • 3 total findings • Sherlock • axelot

#26

medium

Maker position creation will be DOSed in some cases for revert on zero tokens.

medium

`NFTManager.tokenURI()` always reverts because `_generateMetadata` reads the wrong storage

medium

A maker reducing liquidity early will freeze JIT penalties in the diamond, affecting protocol revenues

Aug '25

USG - Tangent

USG - Tangent

7.95 USDC • 2 total findings • Sherlock • axelot

#61

high

Users can supply rogue `controlTower` address to `migrateFrom` and steal from other users

medium

`zappingProxy.zapProxy` is incompatible with `USDT`

Yield Basis

Yield Basis

44.80 USDC • 1 total finding • Sherlock • axelot

#11

medium

`InflationaryVest` can be drained

Jul '25

Malda

Malda

962.00 USDC • 3 total findings • Sherlock • axelot

#15

high

Rebalancer can divert funds by choosing an arbitrary receiver, escalating its privileges

medium

A decimal mismatch in `MixedPriceOracleV4` makes the oracle always select `eOracle`, breaking the expected functionality and causing DoS when eOracle is stale

medium

Any rebalancer will permanently block rebalancing on a `dstChainId, token` pair causing inability to rebalance for the protocol

Mellow Flexible Vaults

Mellow Flexible Vaults

0.04 USDC • 1 total finding • Sherlock • axelot

#43

medium

Transfer whitelist check is inverted for `TokenizedShareManager`, breaking the transfer whitelist functionality

Jan '25

Peapods

Peapods

130.12 USDC • 1 total finding • Sherlock • axelot

#24

medium

Incorrect address of `V3_POS_MGR` on `Base` would break `V3Locker`