https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/cd4c26e5-90c8-4df4-9be7-850d408836a8.jpg

jonatascm

Security Researcher

Contact Me

High

Total

Medium

Total

$12.21K

Total Earnings

#477 All Time

37x

Payouts

1x

3rd Places

9x

Top 10

19x

Top 25

All

Sherlock

Code4rena

Cantina

CodeHawks

Feb '25

defi-app-contracts

1,028.94 USDC • 3 total findings • Cantina • jonatascm

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

Jan '25

inclusive-monorepo

1,096.34 USDC • 11 total findings • Cantina • jonatascm

high

Finding not yet public.

high

Finding not yet public.

high

Finding not yet public.

high

Finding not yet public.

high

Finding not yet public.

high

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

silo-contracts-v2

189.77 USDC • 1 total finding • Cantina • jonatascm

#18

high

Finding not yet public.

Dec '24

Soon

438.38 USDC • 1 total finding • Cantina • jonatascm

#13

medium

Finding not yet public.

Oct '24

mev-commit

13.67 USDC • 1 total finding • Cantina • jonatascm

#39

high

Finding not yet public.

Sep '24

Royco Protocol

12.14 USDC • 1 total finding • Cantina • jonatascm

#61

high

Finding not yet public.

Aug '24

Fjord Token Staking

0.19 USDC • 1 total finding • CodeHawks • jonatascm

#20

medium

`FjordAuction` incorrect `block.timestamp` check allows users to bid after calling `auctionEnd` to claim more tokens than they should

Jun '24

grass

1,881.74 USDC • 3 total findings • Cantina • jonatascm

high

Finding not yet public.

high

Finding not yet public.

high

Finding not yet public.

May '24

safe-extensions

837.2 USDC • 2 total findings • Cantina • jonatascm

#20

medium

Finding not yet public.

medium

Finding not yet public.

Jan '24

Blast

1,098.04 USDC • 1 total finding • Cantina • jonatascm

#44

medium

Finding not yet public.

Aug '23

Sparkn

199.03 USDC • 2 total findings • CodeHawks • jonatascm

#26

high

The same signature can be used in different `distribution` implementation causing that the caller who owns the signature, can distribute on unauthorized implementations

low

DAI Tokens at Risk Due to Lack of address(0) Check in distribute

Jul '23

Beedle - Oracle free perpetual lending

167.39 USDC • 6 total findings • CodeHawks • jonatascm

#27

high

Sandwich attack to steal all ERC-20 tokens in the Fees contract

high

[H-04] Lender#buyLoan - Malicious user could take over a loan for free without having a pool because of wrong access control

high

update() not getting called right after a WETH amount has been sent will cause users to lose staking rewards

high

Token spending by Uniswap router doesn't get approved

high

WETH staking rewards accumulated before the first staker deposits remain unutilized and stuck in the `Staking` contract

medium

No expiration deadline leads to losing a lot of funds

Foundry DeFi Stablecoin CodeHawks Audit Contest

0.78 USDC • 2 total findings • CodeHawks • jonatascm

#137

medium

Chainlink oracle will return the wrong price if the aggregator hits `minAnswer`

medium

All of the USD pair price feeds doesn't have 8 decimals

CodeHawks Escrow Contract - Competition Details

0.00 USDC • 1 total finding • CodeHawks • jonatascm

#96

low

Constructor of `Escrow` should make sure that `buyer`, `seller`, `arbiter` are different from each other.

Mar '23

Telcoin Update

128.97 USDC • 1 total finding • Sherlock • jonatascm

medium

Malfunction in `transferERCToBridge` will eventually lead to stop bridging tokens

Taurus

183.09 USDC • 1 total finding • Sherlock • jonatascm

#10

high

Computing collateral ratio does not take into account the tokens decimals

Feb '23

OlympusDAO

504.10 USDC • 3 total findings • Sherlock • jonatascm

#15

high

Incorrect calculation of cachedUserRewards

high

cachedUserRewards increasing forever

medium

Incorrect calculation of ohmRemoved

Jan '23

Cooler

55.05 USDC • 2 total findings • Sherlock • jonatascm

#26

high

Not validating transfer and transferFrom could lead to loss of funds

medium

Possibility of leave amount of collateral in while repaying

Biconomy - Smart Contract Wallet contest

125.51 USDC • 1 total finding • Code4rena • jonatascm

#43

high

Destruction of the `SmartAccount` implementation

UXD Protocol

201.11 USDC • 1 total finding • Sherlock • jonatascm

#21

high

Rebalance in PerpDepository don't have slippage protection

Dec '22

Escher contest

31.15 USDC • 4 total findings • Code4rena • jonatascm

#58

high

`LPDA` price can underflow the price due to bad settings and potentially brick the contract

medium

ETH will get stuck if all NFTs do not get sold.

medium

Sale contracts can be bricked if any other minter mints a token with an id that overlaps the sale

medium

Use of `payable.transfer()` Might Render ETH Impossible to Withdraw

NounsDAO

114.65 USDC • 1 total finding • Sherlock • jonatascm

medium

Lack of validation of `startTime` and `stopTime` when creating new Stream

Nov '22

Opyn Crab Netting

35.80 USDC • 1 total finding • Sherlock • jonatascm

#23

high

Front-running to DoS the auctions

Isomorph

79.39 USDC • 1 total finding • Sherlock • jonatascm

#23

medium

`TIME_DELAY` misconfiguration for isoUSDToken and CollateralBook

Buffer Finance

71.36 USDC • 2 total findings • Sherlock • jonatascm

medium

Not compatible with fee-on-transfer tokens

medium

No return validation in token transfer

Chainlink Staking contest

139.59 USDC • Code4rena • jonatascm

#17

Sep '22

Y2k Finance contest

89.45 USDC • Code4rena • jonatascm

#44

Nouns Builder contest

60.77 USDC • Code4rena • jonatascm

#97

Aug '22

Sentiment

3.50 USDC • 1 total finding • Sherlock • jonatascm

#26

medium

Missing verification in `getEthPrice` and `getPrice` could lead to stale/incorrect price

FIAT DAO veFDT contest

733.9 USDC • 2 total findings • Code4rena • jonatascm

high

Unsafe usage of ERC20 transfer and transferFrom

medium

The current implementation of the VotingEscrow contract doesn't support fee on transfer tokens

Foundation Drop contest

41.2 USDC • Code4rena • jonatascm

#59

Jul '22

Swivel v3 contest

1,098.49 USDC • 2 total findings • Code4rena • jonatascm

#10

medium

Swivel.setFee() is implemented wrongly.

medium

Error in allowance logic

Fractional v2 contest

282.85 USDC • 2 total findings • Code4rena • jonatascm

#42

high

Cash-out from a successful buyout allows an attacker to drain Ether from the `Buyout` contract

high

```migrateFractions``` may be called more than once by the same user which may lead to loss of tokens for other users

Juicebox V2 contest

158.58 USDC • 2 total findings • Code4rena • jonatascm

#31

high

ORACLE DATA FEED CAN BE OUTDATED YET USED ANYWAYS WHICH WILL IMPACT ON PAYMENT LOGIC

medium

Use a safe transfer helper library for ERC20 transfers

May '22

veToken Finance contest

1,017.13 USDT • 1 total finding • Code4rena • jonatascm

#19

medium

Booster's shutdownPool can freeze user funds

Cally contest

30.09 USDC • Code4rena • jonatascm

#76

Cudos contest

65.8 USDC • Code4rena • jonatascm

#53