khaye26

Security Researcher

never place your private keys in .env

Contact Me

High

Total

Medium

Total

$1.77K

Total Earnings

#1208 All Time

13x

Payouts

1x

1st Places

2x

Top 10

3x

Top 25

All

Sherlock

Cantina

Nov '25

stNXM by EaseDeFi

40.91 USDC • 3 total findings • Sherlock • khaye26

#24

high

Uniswap V3 Spot Price Manipulation Enables Share Price Manipulation in stNXM Vault

medium

Insufficient Uniswap V3 Observation Cardinality in `StNxmOracle::price()`

medium

`StNxmOracle::sanePrice` check will revert on normal price movements

Privacy Cash

6.02 USDC • Sherlock • khaye26

#56

Findings not publicly available for private contests.

Oct '25

Saffron Fixed Income Vaults

9.25 USDC • Sherlock • khaye26

#53

Sep '25

Super DCA Liquidity Network

30.55 OP • 2 total findings • Sherlock • khaye26

#32

high

Traders will claim retroactive cashback rewards for ineligible epochs

medium

Wrong Accounting for users

Ammplify

34.34 USDC • 1 total finding • Sherlock • khaye26

#59

medium

Vault Removal Ignores Direct Token Transfers

Aug '25

USG - Tangent

5.60 USDC • 1 total finding • Sherlock • khaye26

#63

medium

transferFrom in stETH will transfer 1-2 less way, which would result in revert in consequent functions, because of not enough balance

Neutrl Protocol

941.02 USDC • 1 total finding • Sherlock • khaye26

medium

Fully blacklisted users can stake and specify a different receiver address

Jul '25

Mellow Flexible Vaults

163.25 USDC • 1 total finding • Sherlock • khaye26

#30

high

Improper Handling of Native ETH in `getLiquidAssets` Leads to Potential Denial of Service

DeBank

3.63 USDC • Sherlock • khaye26

#96

Notional Exponent

134.23 USDC • 1 total finding • Sherlock • khaye26

#34

medium

Chain-Specific Interface Mismatch in Convex Deposit Function

Jun '25

solaxy

393.52 USDC • 1 total finding • Cantina • Khaye

medium

Finding not yet public.

DODO Cross-Chain DEX

10.81 USDC • 1 total finding • Sherlock • khaye26

#55

high

`_doMixSwap` blindly approves whatever token is specified in params.fromToken

May '25

LEND

2.53 USDC • 2 total findings • Sherlock • khaye26

#105

medium

Borrowers will pay excessive interest due to double interest calculation in `CoreRouter::borrow`

medium

Usage of IERC20 transfer method would fail on some tokens due to lack of return of boolean value