https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/4e939f6f-5567-4877-8dab-5fd89e2770cd.jpg

ljj

Security Researcher

trying to make web3 more secure Security research portfolio: https://github.com/utkuerkin/Security-Research-Findings

Contact Me

High

8

Total

Medium

8

Total

$8.82K

Total Earnings

#566 All Time

9x

Payouts

gold

2x

1st Places

silver

1x

2nd Places

bronze

2x

3rd Places

All

Sherlock

Code4rena

CodeHawks

Nov '24

vVv Launchpad - Investments & Token distribution

vVv Launchpad - Investments & Token distribution

94.59 USDC • 1 total finding • Sherlock • ljj

gold

high

Attacker will steal funds from KYC'd users by frontrunning `claim`

Oct '24

Dria

Dria

4,045.72 USDC • 3 total findings • CodeHawks • ljj

gold

high

No protection implemented against listing clone NFTs

medium

Users can list assets with price < 1 ERC20 (ETH, WETH), leading to potential DoS vulnerability.

medium

BuyerAgent Batch Purchase Failure Due to Asset Transfer or Approval Revocation

Flow

Flow

2,494.34 USDC • 1 total finding • CodeHawks • ljj

bronze

low

It is possible to avoid paying the `protocolFee`

Apr '24

DYAD

DYAD

703.52 USDC • 7 total findings • Code4rena • ljj

#11

high

Attacker can make 0 value deposit() calls to deny user from redeeming or withdrawing collateral

high

Design flaw and mismanagement in vault licensing leads to double counting in collateral ratios and positions collateralized entirely with kerosine

high

Kerosene collateral is not being moved on liquidation, exposing liquidators to loss

high

Unable to withdraw Kerosene from `vaultmanagerv2::withdraw` as it expects a `vault.oracle()` method which is missing in Kerosene vaults

medium

`VaultManagerV2.sol::burnDyad` function is missing an `isDNftOwner` modifier, allowing a user to burn another user's minted DYAD

medium

Attacker can frontrun to prevent vaults from being removed from the dNFT owner's position

medium

Liquidating positions with bounded Kerosen could be unprofitable for liquidators

Mar '24

RadicalxChange

RadicalxChange

1.18 USDC • 1 total finding • Sherlock • ljj

bronze

high

[H-01] Highest bidder can cancel their bid and withdraw their collateral.

Moonwell

Moonwell

1,000 USDC • 1 total finding • CodeHawks • ljj

silver

low

Updated `getCashPrior()` function returns incorrect amount of funds owned by the protocol.

Jan '24

Covalent

Covalent

67.18 USDC • 1 total finding • Sherlock • ljj

#13

medium

Delegators can cause loss of rewards to validators.

Dec '23

The Standard

The Standard

331.45 USDC • 1 total finding • CodeHawks • ljj

#11

medium

Attacker can force reduce `minAmountOut` from vault swaps, making they vulnerable to being sandwiched.

Jul '23

Foundry DeFi Stablecoin CodeHawks Audit Contest

Foundry DeFi Stablecoin CodeHawks Audit Contest

78.27 USDC • 2 total findings • CodeHawks • ljj

#19

high

Liquidation Is Prevented Due To Strict Implementation of Liqudation Bonus

medium

Anyone can burn **DecentralizedStableCoin** tokens with `burnFrom` function