https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/968e1b70-b2a9-488a-878f-899477b22663.jpg

hunter_w3b

Security Researcher

Smart Contract Security Researcher ⚔️

Contact Me

High

Total

Medium

Total

$3.06K

Total Earnings

#1061 All Time

20x

Payouts

1x

1st Places

1x

2nd Places

1x

3rd Places

All

Sherlock

CodeHawks

Dec '24

Tally ARB Staker

130.75 USDC • Sherlock • hunter_w3b

#20

Nov '24

Chiliz Chain System Contracts

151.22 USDC • Sherlock • hunter_w3b

#14

Findings not publicly available for private contests.

vVv Launchpad - Investments & Token distribution

94.59 USDC • 1 total finding • Sherlock • hunter_w3b

high

Malicious User Will Steal Rewards by Front-Running a Claim Transaction

Telcoin Update #2

121.05 USDC • Sherlock • hunter_w3b

#19

Oct '24

Covalent - EWM Light Client

453.76 USDC • Sherlock • hunter_w3b

Findings not publicly available for private contests.

AXION

111.80 USDC • 1 total finding • Sherlock • hunter_w3b

#10

medium

MasterAMO should not use the `initializer` modifier

Sep '24

Liquid Staking

19.41 USDC • 1 total finding • CodeHawks • hunter_w3b

#39

medium

Remove splitter will always revert if there are some rewards left on splitter contract

Aug '24

Cork Protocol

91.50 USDC • 2 total findings • Sherlock • hunter_w3b

#13

high

Double-Counting of Redemption Asset (RA) in `_redeemCtDsAndSellExcessCt` Function

medium

Incorrect Deposit Pausing Logic in `LVDepositNotPaused::ModuleState` Modifier

Rumpel Point Tokenization Protocol

163.48 USDC • Sherlock • hunter_w3b

Tadle

8.32 USDC • 4 total findings • CodeHawks • hunter_w3b

#99

high

Incorrect set up and logic of `referralInfoMap` in `SystemConfig::updateReferrerInfo` function

high

Native token withdrawal fails until manually approved

low

`listOffer` Unsafely References Fungible Identifiers

low

Validation of `collateralRate` in `PerMarkets::createOffer` function

Jul '24

MagicSea - the native DEX on the IotaEVM

0.08 USDC • 1 total finding • Sherlock • hunter_w3b

#64

medium

The quantity is calculated incorrectly when depositing Fee on Transfer Tokens.

May '24

Tokensoft Distributor Contracts Update

303.16 USDC • 1 total finding • Sherlock • hunter_w3b

medium

Claim Function Fails in `PerAddressTrancheVestingMerkleDistributor` Due to Empty Data

Sophon Farming Contracts

1,196.48 USDC • 1 total finding • Sherlock • hunter_w3b

high

Protocol supports `eETH` but doesn't consider its also a rebase token like `stETH`

Jan '24

Covalent

67.18 USDC • 1 total finding • Sherlock • hunter_w3b

#13

medium

Sandwich Attack in Reward Validators

Oct '23

Steadefi

98.00 USDC • 3 total findings • CodeHawks • hunter_w3b

#31

medium

`emergencyClose()` may fail to repay any debt

low

Lack of events for critical actions

low

Chainlink aggregators return the incorrect price if it drops below `minAnswer`

Sep '23

DittoETH

5.78 USDC • 1 total finding • CodeHawks • hunter_w3b

#54

low

Loss of precision in `twapPriceInEther` due to division before multiplication

Aug '23

Sparkn

6.71 USDC • 2 total findings • CodeHawks • hunter_w3b

#65

low

Signature missing nonce & expiration deadline

low

Potential DOS due to Gas Exhaustion Due to Large Array Iteration in `_distribute` Function

Jul '23

Beedle - Oracle free perpetual lending

24.20 USDC • 7 total findings • CodeHawks • hunter_w3b

#107

gas

Multiple accesses of a mapping/array should use a local variable cache.

gas

The `for loops` inside the borrow(), repay(), giveLoan() & startAuction() functions in Lender contract are probably gas-guzzlers

gas

Uncheck Arithmetic where overflow/underflow impossible

gas

Using Private Rather Than Public For Constants,Saves Gas

gas

Use if + custom errors instead of using require + string

gas

Using delete statement can save gas

gas

ADD UNCHECKED{} FOR SUBTRACTIONS WHERE THE OPERANDS CANNOT UNDERFLOW BECAUSE OF A PREVIOUS IF-STATEMENT

Foundry DeFi Stablecoin CodeHawks Audit Contest

3.33 USDC • 3 total findings • CodeHawks • hunter_w3b

#101

low

Zero address check for tokens

low

Pragma isn't specified correctly which can lead to nonfunction/damaged contract when deployed on Arbitrum

gas

[I-10] Functions not used internally could be marked external

CodeHawks Escrow Contract - Competition Details

12.86 USDC • 2 total findings • CodeHawks • hunter_w3b

#70

gas

Reentrancy guard and nonReentrant modifier not required.

gas

Refactor `inState` modifier for high gas savings