https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/4c31e1db-3711-48d6-9a68-866b3de4ac33.png

dobrevaleri

Security Researcher

Web3 Security Researcher | Intern @PashovAuditGrp

High

Total

Medium

Total

$5.40K

Total Earnings

#721 All Time

20x

Payouts

1x

1st Places

2x

2nd Places

2x

3rd Places

All

Sherlock

Code4rena

Cantina

CodeHawks

Mar '25

Symmio, Staking and Vesting

0.00 USDC • 1 total finding • Sherlock • dobrevaleri

#18

medium

Unrestricted `notifyRewardAmount` function allows reward manipulation

Feb '25

Rova

0.04 USDC • 1 total finding • Sherlock • dobrevaleri

medium

Incorrectly using delta currency amount instead of delta token amounts in `updateParticipaion()`

Jan '25

IQ AI

243.25 USDC • 1 total finding • Code4rena • dobrevaleri

#13

high

Adversary can win proposals with voting power as low as 4%

daao-contracts

89.92 USDC • 5 total findings • Cantina • dobrevaleri

#41

high

Finding not yet public.

high

Finding not yet public.

high

Finding not yet public.

high

Finding not yet public.

medium

Finding not yet public.

Plaza Finance

311.95 USDC • 7 total findings • Sherlock • dobrevaleri

#26

high

Auction will never succeed due to wrong check

high

Funds might remain locked in `BalancerRouter` when depositing in Balancer pool

high

The fee is double charged on every `create` or `redeem`

medium

Low TVL and high Leverage Supply will DoS the redeem of Leverage tokens

medium

Balancer LP tokens might be locked inside `BalancerRouter`

medium

Incomplete handling of failed auctions

medium

Redeeming all leverage tokens, will DoS their creation

Aave v3.3

529.42 USDC • Sherlock • dobrevaleri

#44

Dec '24

Ethos Reputation Market Fix Review Contest

144.76 USDC • 1 total finding • Sherlock • dobrevaleri

medium

Rounding will lead to broken invariant.

Alchemix Transmuter

513.57 op • 3 total findings • CodeHawks • dobrevaleri

#10

medium

Incorrect Total Assets Calculation in _harvestAndReport Leading to Share Value Manipulation and Irredeemable Assets

medium

not adding `claimable` balance to the total assets in `_harvestAndReport` can cause losses.

low

Old router retains token allowance after update

Nov '24

Ethos Network Financial Contracts

130.79 USDC • 4 total findings • Sherlock • dobrevaleri

#22

high

Reputation market will be insolvent, due to incorrect increase of market funds when buying.

high

Incorrect fee calculation will overcharge users buying votes.

medium

Incorrect calculation of fees in `EthosVouch` will cause partial loss of user's principle

medium

Missing slippage protection on `sellVotes()`

vVv Launchpad - Investments & Token distribution

94.59 USDC • 1 total finding • Sherlock • dobrevaleri

high

Attacker can steal tokens intended for KYC-verified address

Telcoin Update #2

179.13 USDC • Sherlock • dobrevaleri

#14

Oct '24

Ethos Network Social Contracts

1,485.02 USDC • 2 total findings • Sherlock • dobrevaleri

medium

Deleted address will still have full control over the profile.

medium

Upgrades might cause storage collision

Gamma Brevis Rewarder

131.06 OP • 1 total finding • Sherlock • dobrevaleri

high

Users are unable to claim in more than 1 epoch.

stakeup-bloomv2

114.5 USDC • 4 total findings • Cantina • dobrevaleri

#56

high

Finding not yet public.

high

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

Sep '24

Saffron Lido Vaults

1,422.84 USDC • 1 total finding • Sherlock • dobrevaleri

high

Unaccounted protocol fee will lead to funds getting locked

Aug '24

Rumpel Point Tokenization Protocol

2.76 USDC • Sherlock • dobrevaleri

#29

Fjord Token Staking

0.19 USDC • 1 total finding • CodeHawks • dobrevaleri

#20

medium

`FjordAuction` incorrect `block.timestamp` check allows users to bid after calling `auctionEnd` to claim more tokens than they should

Winnables Raffles

5.17 USDC • 2 total findings • Sherlock • dobrevaleri

#31

high

Attacker can abuse `cancelRaffle` to DoS the protocol

high

`refundPlayers()` will prevent Admin from withdrawing assets

Tadle

0.00 USDC • 1 total finding • CodeHawks • dobrevaleri

#177

high

TokenManager - Unlimited withdraw

Jul '24

TraitForge

0.02 USDC • 4 total findings • Code4rena • dobrevaleri

#87

high

`mintToken()`, `mintWithBudget()`, and `forge()` in the `TraitForgeNft` Contract Will Fail Due to a Wrong Modifier Used in `EntropyGenerator.initializeAlphaIndices()`

high

The maximum number of generations is infinite

medium

Pause and unpause functions are inaccessible

medium

Discrepancy between nfts minted, price of nft when a generation changes & position of `_incrementGeneration()` inside `_mintInternal()` & `_mintNewEntity()`