https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/968e1b70-b2a9-488a-878f-899477b22663.jpg

hunter_w3b

Security Researcher

Smart Contract Security Researcher ⚔️

Contact Me

High

Total

Medium

Total

$21.17K

Total Earnings

#424 All Time

87x

Payouts

1x

1st Places

1x

2nd Places

1x

3rd Places

All

Sherlock

Code4rena

CodeHawks

Nov '24

Chiliz Chain System Contracts

151.22 USDC • Sherlock • hunter_w3b

#14

Findings not publicly available for private contests.

vVv Launchpad - Investments & Token distribution

94.59 USDC • 1 total finding • Sherlock • hunter_w3b

high

Malicious User Will Steal Rewards by Front-Running a Claim Transaction

Oct '24

Covalent - EWM Light Client

453.76 USDC • Sherlock • hunter_w3b

Findings not publicly available for private contests.

AXION

111.80 USDC • 1 total finding • Sherlock • hunter_w3b

#10

medium

MasterAMO should not use the `initializer` modifier

Sep '24

Liquid Staking

19.41 USDC • 1 total finding • CodeHawks • hunter_w3b

#39

medium

Remove splitter will always revert if there are some rewards left on splitter contract

Aug '24

Cork Protocol

91.50 USDC • 2 total findings • Sherlock • hunter_w3b

#13

high

Double-Counting of Redemption Asset (RA) in `_redeemCtDsAndSellExcessCt` Function

medium

Incorrect Deposit Pausing Logic in `LVDepositNotPaused::ModuleState` Modifier

Tadle

8.32 USDC • 4 total findings • CodeHawks • hunter_w3b

#99

high

Incorrect set up and logic of `referralInfoMap` in `SystemConfig::updateReferrerInfo` function

high

Native token withdrawal fails until manually approved

low

`listOffer` Unsafely References Fungible Identifiers

low

Validation of `collateralRate` in `PerMarkets::createOffer` function

Jul '24

MagicSea - the native DEX on the IotaEVM

0.08 USDC • 1 total finding • Sherlock • hunter_w3b

#64

medium

The quantity is calculated incorrectly when depositing Fee on Transfer Tokens.

Jun '24

Thorchain

397.82 USDC • 1 total finding • Code4rena • hunter_w3b

#14

medium

Due to the use of `msg.value` in for loop, anyone can drain all the funds from the `THORChain_Router` contract

May '24

Tokensoft Distributor Contracts Update

303.16 USDC • 1 total finding • Sherlock • hunter_w3b

medium

Claim Function Fails in `PerAddressTrancheVestingMerkleDistributor` Due to Empty Data

Sophon Farming Contracts

1,196.48 USDC • 1 total finding • Sherlock • hunter_w3b

high

Protocol supports `eETH` but doesn't consider its also a rebase token like `stETH`

Apr '24

Renzo

1.52 USDC • 3 total findings • Code4rena • hunter_w3b

#53

high

Incorrect withdraw queue balance in TVL calculation

medium

Deposits will always revert if the amount being deposited is less than the bufferToFill value

medium

Lack of slippage and deadline during withdraw and deposit

Mar '24

Revert Lend

193.61 USDC • 1 total finding • Code4rena • hunter_w3b

#40

medium

Asymmetric calculation of price difference

Jan '24

Covalent

67.18 USDC • 1 total finding • Sherlock • hunter_w3b

#13

medium

Sandwich Attack in Reward Validators

Oct '23

Steadefi

98.00 USDC • 3 total findings • CodeHawks • hunter_w3b

#31

medium

`emergencyClose()` may fail to repay any debt

low

Lack of events for critical actions

low

Chainlink aggregators return the incorrect price if it drops below `minAnswer`

Sep '23

DittoETH

5.78 USDC • 1 total finding • CodeHawks • hunter_w3b

#54

low

Loss of precision in `twapPriceInEther` due to division before multiplication

Aug '23

Sparkn

6.71 USDC • 2 total findings • CodeHawks • hunter_w3b

#65

low

Signature missing nonce & expiration deadline

low

Potential DOS due to Gas Exhaustion Due to Large Array Iteration in `_distribute` Function

Jul '23

Beedle - Oracle free perpetual lending

24.20 USDC • 7 total findings • CodeHawks • hunter_w3b

#107

gas

Multiple accesses of a mapping/array should use a local variable cache.

gas

The `for loops` inside the borrow(), repay(), giveLoan() & startAuction() functions in Lender contract are probably gas-guzzlers

gas

Uncheck Arithmetic where overflow/underflow impossible

gas

Using Private Rather Than Public For Constants,Saves Gas

gas

Use if + custom errors instead of using require + string

gas

Using delete statement can save gas

gas

ADD UNCHECKED{} FOR SUBTRACTIONS WHERE THE OPERANDS CANNOT UNDERFLOW BECAUSE OF A PREVIOUS IF-STATEMENT

Foundry DeFi Stablecoin CodeHawks Audit Contest

3.33 USDC • 3 total findings • CodeHawks • hunter_w3b

#101

low

Zero address check for tokens

low

Pragma isn't specified correctly which can lead to nonfunction/damaged contract when deployed on Arbitrum

gas

[I-10] Functions not used internally could be marked external

CodeHawks Escrow Contract - Competition Details

12.86 USDC • 2 total findings • CodeHawks • hunter_w3b

#70

gas

Reentrancy guard and nonReentrant modifier not required.

gas

Refactor `inState` modifier for high gas savings

Apr '23

Rubicon v2

25.03 USDC • 1 total finding • Code4rena • hunter_w3b

#93

medium

Calling `ExpiringMarket.stop` and `ExpiringMarket.isClosed` functions cannot pause any functionlities of the market