https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/1f8f2473-53f5-44ce-817f-5a4b8f98fb15.jpg

ge6a

Security Researcher

Independent security researcher, 10+ years of experience in software development

Contact Me

High

Total

Medium

Total

$44.90K

Total Earnings

#194 All Time

29x

Payouts

2x

1st Places

3x

2nd Places

1x

3rd Places

All

Sherlock

Code4rena

CodeHawks

Mar '25

Symmio, Staking and Vesting

1,928.19 USDC • 1 total finding • Sherlock • ge6a

medium

Double spending attack in the Vesting contract

Dec '24

QuantAMM

68.63 op • 5 total findings • CodeHawks • ge6a

#55

high

Fee Evasion via LP Token Transfer Resets Deposit Value

medium

quantAMMSwapFeeTake used for both getQuantAMMSwapFeeTake and getQuantAMMUpliftFeeTake.

medium

“Uplift Fee” Incorrectly Falls Back to Minimum Fee Due to Integer Division

medium

Incorrect implementation of QuantammMathGuard.sol#_clampWeights.

low

Inconsistent timestamp storage when the LPNFT is transferred.

Nov '24

Chiliz Chain System Contracts

6,306.66 USDC • Sherlock • ge6a

Findings not publicly available for private contests.

Sep '24

Boost Core Incentive Protocol

8,348.66 USDC • 6 total findings • Sherlock • ge6a

high

Revert of SignerValidator.validate() caused by bug in IncentiveBits.setOrThrow()

high

clawback() can't be executed because the owner is always BoostCore

medium

Fee on transfer tokens break some of the contracts

medium

The boost's owner can steal the protocol's profit using referralFee = 100%.

medium

block.prevdao is not secure source of randomness and could be manipulated

medium

Issue with rebasing tokens in ERC20Incentive

Aug '24

Tadle

3.11 USDC • 4 total findings • CodeHawks • ge6a

#136

high

Incorrect set up and logic of `referralInfoMap` in `SystemConfig::updateReferrerInfo` function

high

Native token withdrawal fails until manually approved

high

`DeliveryPlace::settleAskTaker` Has Incorrect Access Control

high

Formulaic Error Rounds Down Causing Total Loss Of Funds For Bid Takers During Abort

Jul '24

ArkProject: NFT Bridge

63.65 USDC • 2 total findings • CodeHawks • ge6a

#38

high

`Tokens` Are Automatically Whitelisted Upon Creation And Binding Even When `_whiteListEnabled == false`

medium

Starknet tokens deposited with use_withdraw_auto can never be withdrawn

MakerDAO Endgame

3,422.49 USDC • Sherlock • ge6a

#29

CCIP v1.5

1,265.29 USDC • CodeHawks • ge6a

Jun '24

dHEDGE

271.16 USDC • Sherlock • ge6a

#12

Findings not publicly available for private contests.

May '24

Sablier

6,081.99 USDC • 3 total findings • CodeHawks • ge6a

medium

Insufficient input validation on `SablierV2NFTDescriptor::safeAssetSymbol` allows an attacker to obtain stored XSS

medium

`SablierV2Lockup.sol` - The caller of withdraw and renounce can skip callbacks, by sending less gas

low

Cancelling a Merkle Lockup is only callable by `initialAdmin` even after `admin` had been modified

Apr '24

FairSide Network

3,087.65 USDC • Sherlock • ge6a

Findings not publicly available for private contests.

Alchemix - Optimism Bridging and Reward Routing

2,125 USDC • 1 total finding • Sherlock • ge6a

high

Maximum allowable slippage can be exceeded

Beanstalk Part 2

35.74 USDC • 1 total finding • CodeHawks • ge6a

#11

low

Missing the `lookback` parameter when invoking the `getWstethUsdPrice()` in the `getTokenPrice` function

Mar '24

RadicalxChange

1.18 USDC • 1 total finding • Sherlock • ge6a

high

_cancelAllBids does not check if the current bidder is the highest bid bidder

Feb '24

Perpetual

5,411.49 USDC • 2 total findings • Sherlock • ge6a

high

Draining maker through funding fee

medium

Loss of funds for trader because whitelisted maker can't be liquidated

Smilee Finance

378.73 USDC • 2 total findings • Sherlock • ge6a

medium

Permanent Dos through trackVaultFee()

medium

Manipulation of _state.liquidity.totalDeposit

Jan '24

Arcadia

36.24 USDC • 1 total finding • Sherlock • ge6a

medium

DOS of StakedStargateAM

Flat Money

234.48 USDC • 2 total findings • Sherlock • ge6a

#15

medium

DOS for long periods of time due to revert in getPrice()

medium

skewFractionMax can be significantly exceeded, putting LPs at risk

SYMM IO

314.01 USDC • Sherlock • ge6a

Ubiquity

1,866.60 USDC • 1 total finding • Sherlock • ge6a

medium

Protocol insolvency and the user's inability to redeem their tokens

Dec '23

Olympus RBS 2.0

2,971.63 USDC • 3 total findings • Sherlock • ge6a

high

Wrong methodology for stable BPT price calculation

high

getBunniTokenPrice wrongly returns the total price of all tokens

medium

Using incorrect function to determine the token supply in a Balancer weighted pool

Nov '23

Nouns Builder

21.94 USDC • 1 total finding • Sherlock • ge6a

high

If reservedUntilTokenId > 100, the first founder will receive fewer tokens than expected

Kelp DAO | rsETH

143.01 USDC • 1 total finding • Code4rena • ge6a

#27

medium

Lack of slippage control on LRTDepositPool.depositAsset

Oct '23

LooksRare

246.50 USDC • 1 total finding • Sherlock • ge6a

medium

fulfillRandomWords() could revert under certain circumstances

Ethena Labs

123.66 USDC • 1 total finding • Code4rena • ge6a

#26

medium

``FULL_RESTRICTED`` Stakers can bypass restriction through approvals

Badger eBTC Audit + Certora Formal Verification Competition

117.51 USDC • Code4rena • ge6a

#15

Open Dollar

22 USDC • 1 total finding • Code4rena • ge6a

#52

medium

`ODSafeManager#allowSAFE()` cannot be executed either by the proxy contract or any other address.

Sep '23

Venus Prime

4.37 USDC • Code4rena • ge6a

#39

Aug '23

Dopex

0.01 USDC • 1 total finding • Code4rena • ge6a

#129

high

The settle feature will be broken if attacker arbitrarily transfer collateral tokens to the PerpetualAtlanticVaultLP