https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/11d6e5a7-5cec-4b1b-99af-c1e29a027cd8.jpg

giraffe

Security Researcher

Security Researcher @GuardianAudits Multiple top placings in public audit contests Ex-Air Force Pilot 🚁

Contact Me

High

13

Total

Medium

19

Total

$33.63K

Total Earnings

#243 All Time

13x

Payouts

silver

2x

2nd Places

bronze

2x

3rd Places

regular

8x

Top 10

All

Sherlock

Code4rena

Cantina

Jul '24

MakerDAO Endgame

MakerDAO Endgame

7,235.88 USDC • Sherlock • giraffe

#13

Jun '24

Mellow Modular LRTs

Mellow Modular LRTs

1,768.70 USDC • 1 total finding • Sherlock • giraffe

#5

medium

Bad price assumption that stETH equals WETH

Apr '24

FairSide Network

FairSide Network

9,333.27 USDC • Sherlock • giraffe

silver

Findings not publicly available for private contests.

Feb '24

Jala Swap

Jala Swap

618.45 USDC • 2 total findings • Sherlock • giraffe

#4

medium

Permit functions in Routers cannot be called

medium

_update will overflow and break all contract functionality

Rio Network

Rio Network

3,862.80 USDC • 4 total findings • Sherlock • giraffe

#5

high

TVL can be manipulated when withdrawals are triggered outside of Rio

high

queueCurrentEpochSettlement() does not advance current epoch leading to broken withdrawal accounting

high

Deposits may be front-run by malicious operator to steal ETH

medium

Attacker can deposit just before rewards are distributed and steal rewards

opal-contracts

opal-contracts

5,155.61 USDC • 11 total findings • Cantina • giraffe0x

silver

high

Finding not yet public.

high

Finding not yet public.

high

Finding not yet public.

high

Finding not yet public.

high

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

AI Arena

AI Arena

4.43 USDC • 3 total findings • Code4rena • handsomegiraffe

#137

high

Malicious user can stake an amount which causes zero curStakeAtRisk on a loss but equal rewardPoints to a fair user on a win

medium

NFTs can be transferred even if StakeAtRisk remains, so the user's win cannot be recorded on the chain due to underflow, and can recover past losses that can't be recovered(steal protocol's token)

medium

Fighter created by mintFromMergingPool can have arbitrary weight and element

Jan '24

Salty.IO

Salty.IO

2,659.2 USDC • 1 total finding • Code4rena • handsomegiraffe

bronze

medium

Caller of Upkeep may skip step 11 to save gas

JOJO Exchange Update

JOJO Exchange Update

841.79 USDC • 2 total findings • Sherlock • giraffe

bronze

high

Lack of input validation for executeWithdraw leads to total loss of funds

medium

Donation attack can steal other user's funds in FundingRateArbitrage

incentive-contracts

incentive-contracts

1,228.12 USDC • 3 total findings • Cantina • giraffe0x

#16

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

Nov '23

Nouns Builder

Nouns Builder

850.37 USDC • 2 total findings • Sherlock • giraffe

#7

high

First Founder unable to mint token due to tokenId incorrectly set to reservedUntilTokenId

medium

Malicious DOS by pausing contract

Mar '23

Asymmetry contest

Asymmetry contest

45.32 USDC • 3 total findings • Code4rena • handsomegiraffe

#80

high

Staking, unstaking and rebalanceToWeight can be sandwiched (Mainly rETH deposit )

high

`WstEth` derivative assumes a ~1=1 peg of stETH to ETH

medium

No slippage protection on `stake()` in SafEth.sol

Neo Tokyo contest

Neo Tokyo contest

29.67 USDC • Code4rena • handsomegiraffe

#21