https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/542fdf5e-4ace-41b7-9e16-6edc14a95b24.jpg

harry

Security Researcher

High

Total

Medium

Total

$8.65K

Total Earnings

#733 All Time

23x

Payouts

1x

3rd Places

7x

Top 10

10x

Top 25

All

Sherlock

Code4rena

Cantina

Jun '26

DRE App - dreUSD

40.15 USDC • Sherlock • harry

#48

Apr '26

Monetrix

515.16 USDC • 1 total finding • Code4rena • harry

medium

PM borrow liabilities are omitted from backing, allowing phantom surplus settlement

K2

62.94 USDC • 6 total findings • Code4rena • harry

#51

high

Self-liquidation with `receive_a_token = true` bypasses collateral seizure via `from == to` self-transfer in `transfer_on_liquidation`, socializing residual debt to reserve deficit

high

Zero-balance collateral opt-in can make unhealthy positions unliquidatable

high

Same-Asset Borrow Positions Can Become Insolvent With No Working Liquidation Path

medium

Reserve deficit is excluded from borrow-cap and debt-ceiling checks, allowing new borrows above configured risk limits

medium

Prepared Flash Liquidation Can Bypass Collateral Reserve Pause

medium

Disabled oracle assets remain usable through the batch-price TTL cache

Clear Macro by Superfluid

74.51 USDC • Sherlock • harry

#27

Mar '26

Chainlink Payment Abstraction V2

93.98 USDC • 1 total finding • Code4rena • harry

medium

Finding not yet public.

Jan '26

Olas

79.47 USDC • 2 total findings • Code4rena • harry

#47

high

UniswapPriceOracle.validatePrice() TWAP Calculation Flaw

medium

DoS in Liquidity Migration due to Unit Mismatch in UniswapPriceOracle

VII-Finance-Contracts

5.56 OP • 1 total finding • Cantina • harry

#69

medium

Finding not yet public.

Nov '25

Brix Money

1,049.86 USDC • 1 total finding • Code4rena • harry

medium

User can bypass staking restrictions through composer and deposit on another chain

Megapot

355.98 USDC • 1 total finding • Code4rena • harry

high

Unoptimized subset matches counting implementation will exceed tx gas limit on base chain

Oct '25

Centrifuge Protocol V3.1

3,452.81 USDC • 1 total finding • Sherlock • harry

medium

`SimplePriceManager.onUpdate()` lack of forward execution fee leads dependent functions to revert

Hybra Finance

1,212.5 USDC • 2 total findings • Code4rena • harry

high

Assets deposited before calculating shares amount to mint will cause users to mint less shares.

medium

Claiming rewards in GovernanceHYBR will always revert

Sep '25

Super DCA Liquidity Network

232.28 OP • 2 total findings • Sherlock • harry

#17

high

Attacker can front-run liquidity transactions to cause gauge DCA rewards to be lost

high

Gauge emissions per token not per pool allow malicious pools to capture unearned rewards

Rezerve Money

18.97 USDC • Sherlock • harry

#75

Findings not publicly available for private contests.

Aug '25

kuru-contracts

1,258.42 USDC • 1 total finding • Cantina • harry

#17

high

Finding not yet public.

GTE Perps and Launchpad

94.17 USDC • 2 total findings • Code4rena • harry

#67

high

Risk of Gas DoS due to Looping

medium

Rounding down in Quote calculation allows underpriced LaunchToken purchases by Malicious user, compounding protocol loss over multiple buys.

Jul '25

Malda

10.64 USDC • 2 total findings • Sherlock • harry

#44

medium

`wrapAndSupplyOnExtensionMarket` fails due to missing gas fee forwarding

medium

`Rebalancer.sendMsg` uses stale transfer size causing persistent DoS

DeBank

9.22 USDC • Sherlock • harry

#78

Notional Exponent

11.98 USDC • 1 total finding • Sherlock • harry

#49

medium

USDT approval revert leads to position entry failure

Jun '25

Symbiotic Relay

16.16 USDC • 1 total finding • Sherlock • harry

#11

medium

Malicious user can register many operators, leading to DoS in core view functions

DODO Cross-Chain DEX

2.74 USDC • 2 total findings • Sherlock • harry

#68

medium

Non-standard token incompatibility in `GatewaySend::depositAndCall`

medium

`GatewayTransferNative::withdraw` allows attacker to overwrite refund info using the same `externalId` leading to user fund loss

May '25

LEND

5.30 USDC • 2 total findings • Sherlock • harry

#97

high

Incorrect check in `_checkLiquidationValid` may cause healthy accounts to be liquidated

high

`CoreRouter::supply` uses a stale `exchangeRateStored` which causes internal accounting mismatches

Apr '25

Aegis.im YUSD

45.94 OP • 1 total finding • Sherlock • harry

high

Fee calculation logic in `approveRedeemRequest` is incorrect

Kinetiq

4.38 USDC • 1 total finding • Code4rena • harry

#34

high

Users Who Queue Withdrawal Before A Slashing Event Disadvantage Users Who Queue After And Eventually Leads To Loss Of Funds For Them