https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/defaults/default_avatar_2.png

blockace

Security Researcher

Blockchain WhiteHat

Contact Me

High

15

Total

Medium

19

Total

$32.10K

Total Earnings

#290 All Time

10x

Payouts

gold

1x

1st Places

silver

1x

2nd Places

bronze

3x

3rd Places

All

Sherlock

Cantina

Sep '25

BMX Deli Swap

BMX Deli Swap

2,349.12 USDC • 6 total findings • Sherlock • blockace

bronze

high

`notifyUnsubscribe` claims reward incorrectly

high

Attacker can manipulate vote using `sbfBMX`

medium

Fee price is not correct in `Delihook`

medium

`_upsertIncentive` causes precision loss

medium

`DeliHook` doesn't calculate fee using exact swapped amount

medium

`RangePool.sync` doesn't accumulate token when `liquidity == 0`

Ammplify

Ammplify

3,237.67 USDC • 11 total findings • Sherlock • blockace

bronze

high

Unvalidated pool address in `MakerFacet.newMaker` enables collateral drain via malicious V3-like pool

high

Borrow fee uses APY as per-second rate, causing extreme overcharging

high

Dirty sibling liquidity not reallocated after parent borrow causes unallocated positions and incorrect fee accounting

high

Compounding fees width mismatch under-allocates `xCFees`/`yCFees` in `up()`

high

Position fees from UniV3 decomposition are not returned to user in `NFTManager.decomposeAndMint`

medium

Fee curve utilization cast to uint64 wraps 100% utilization to zero, minimizing fees

medium

`NFTManager` limited to 16 NFTs due to per-owner asset cap in `AssetLib`

medium

JIT penalty unfairly applied on burn due to fee-collection timestamp reset

medium

UniV3Decomposer missing ERC165 supportsInterface breaks RFT pull in decompose

medium

ViewWalker.down writes X remainder into Y field, corrupting fee split

medium

`adjustMaker` ignores `recipient` on removal, sending withdrawn tokens to `msg.sender`

Aug '25

kuru-contracts

kuru-contracts

1,210.91 USDC • 1 total finding • Cantina • blockace

#21

high

Finding not yet public.

Neutrl Protocol

Neutrl Protocol

941.02 USDC • 1 total finding • Sherlock • blockace

gold

medium

Fully restricted users can bypass restrictions and stake tokens

Yield Basis

Yield Basis

16,452.58 USDC • 3 total findings • Sherlock • blockace

silver

high

Staker Balance Rebase Vulnerability in LT Contract

medium

Front-runnable adjustment at vote time inflates YB emissions to `LiquidityGauge`

medium

Incorrect assertion prevents setting Gauge Controller

solayer-bridge

solayer-bridge

473.77 USDC • 2 total findings • Cantina • blockace

#20

high

Finding not yet public.

medium

Finding not yet public.

Jul '25

Allbridge Core Yield

Allbridge Core Yield

150.46 USDC • 1 total finding • Sherlock • blockace

bronze

medium

Attacker can do first inflation attack with `subDepositRewards` function

Malda

Malda

41.20 USDC • 1 total finding • Sherlock • blockace

#40

medium

`mTokenGateway._outHere` doesn't check receiver is not blacklisted

Citrea

Citrea

4,633.1 USDC • 1 total finding • Cantina • blockace

#6

high

Finding not yet public.

Mellow Flexible Vaults

Mellow Flexible Vaults

2,609.88 USDC • 7 total findings • Sherlock • blockace

#4

high

Index Calculation Bug in `_handleReport` Function Causes Incorrect Share Allocation

high

Protocol Fee Multiple Accrual in Oracle.submitReports

high

Incorrect performance fee calculation in `FeeManager`

high

`Consensus.checkSignatures` fails to check for duplicate signers

medium

Wrong Index Usage in cancelDepositRequest Function Causes Fenwick Tree Corruption

medium

Protocol Fee Exponential Compounding in ShareModule.handleReport

medium

ShareManager Transfer Whitelist Logic Bug