https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/defaults/default_avatar_6.png

broccoli

Security Researcher

Contact Me

High

19

Total

Medium

8

Total

$132.59K

Total Earnings

#74 All Time

4x

Payouts

gold

1x

1st Places

silver

1x

2nd Places

regular

4x

Top 10

All

Code4rena

May '22

OpenSea Seaport contest

OpenSea Seaport contest

27,024.46 USDC • 1 total finding • Code4rena • broccoli

#6

high

Truncation in `OrderValidator` can lead to resetting the fill and selling more tokens

Feb '22

Anchor contest

Anchor contest

7,144.35 UST • 2 total findings • Code4rena • broccoli

#8

medium

[WP-H0] When transferring tokens not in `whitelist` on Ethereum to Terra with `CrossAnchorBridge.depositStable()`, the funds may get frozen

medium

Potential lock of rewards in the custody contracts

Sep '21

Sushi Trident contest phase 2

Sushi Trident contest phase 2

22,095.11 USDC • 9 total findings • Code4rena • broccoli

silver

high

range fee growth underflow

high

`ConcentratedLiquidityPoolManager`'s incentives can be stolen

high

Unsafe cast in ConcentratedLiquidityPool burn leads to attack

high

Burning does not update reserves

high

Incorrect usage of typecasting in `_getAmountsForLiquidity` lets an attacker steal funds from the pool

high

Overflow in the `mint` function of `ConcentratedLiquidityPool` causes LPs' funds to be stolen

high

Wrong usage of `positionId` in `ConcentratedLiquidityPoolManager`

medium

Cannot claim reward

medium

Users cannot receive rewards from `ConcentratedLiquidityPoolManager` if their liquidity is too large

Sushi Trident contest phase 1

Sushi Trident contest phase 1

76,321.29 USDC • 15 total findings • Code4rena • broccoli

gold

high

absolute difference is not calculated properly when a > b in MathUtils

high

Overflow in the `mint` function of `IndexPool` causes LPs' funds to be stolen

high

Incorrect usage of `_pow` in `_computeSingleOutGivenPoolIn` of `IndexPool`

high

Incorrect multiplication in `_computeSingleOutGivenPoolIn` of `IndexPool`

high

Funds in the pool could be stolen by exploiting `flashSwap` in `HybridPool`

high

Flash swap call back prior to transferring tokens in indexPool

high

Index Pool always swap to Zero

high

IndexPool pow overflows when `weightRatio` > 10.

high

IndexPool's INIT_POOL_SUPPLY is not fair.

high

hybrid pool uses wrong `non_optimal_mint_fee`

high

`IndexPool.mint` The first liquidity provider is forced to supply assets in the same amount, which may cause a significant amount of fund loss

medium

Approximations may finish with inaccurate values

medium

Users are susceptible to back-running when depositing ETH to `TridenRouter`

medium

ConstantProductPool & HybridPool: Adding and removing unbalanced liquidity yields slightly more tokens than swap

medium

Router would fail when adding liquidity to index Pool