maigadoh

Security Researcher

DAO Contributor | 💼 Investment Strategist | 🌐 Web3 Dev | Prompt Engineer | #Crypto #DAO #Web3

Contact Me

High

Total

Medium

Total

$7.21K

Total Earnings

#793 All Time

13x

Payouts

2x

1st Places

7x

Top 10

9x

Top 25

All

Sherlock

Jan '26

Hotstuff

107.11 USDC • Sherlock • maigadoh

#22

Findings not publicly available for private contests.

Flying Tulip

423.07 USDC • Sherlock • maigadoh

#44

Nov '25

Inverse Finance - Junior Tranche

1,191.08 USDC • 2 total findings • Sherlock • maigadoh

medium

JDola inherits Solmate’s ERC4626 where maxDeposit() and maxMint() return type(uint256).max

medium

WithdrawalEscrow.queueWithdrawal charges the full fee on the total only if the user “had a chance to withdraw” (block.timestamp > exitWindowStart)

Sep '25

Super DCA Liquidity Network

262.86 OP • 5 total findings • Sherlock • maigadoh

#10

high

First-Hook Reward Capture Starves Other Pools

high

Reward Accrual Wipe via Premature Index Reset in stake/unstake

high

Pre-Campaign Epochs Cause Cashback Overpayment

medium

Idle-Time Emissions Misallocated to First Post-Zero Staker

medium

Reward Misallocation from Unsettled Mint Rate Change

Dango DEX

10.58 USDC • 1 total finding • Sherlock • maigadoh

#21

medium

Zero amount first mint sets LP>0 with 0–0 reserves, causing division-by-zero deposit DoS

BMX Deli Swap

771.50 USDC • 3 total findings • Sherlock • maigadoh

high

Unbounded pendingRemovals sweep in finalize triggers per-epoch settlement DoS (gas exhaustion)

high

Pool-vs-token lastUpdated mismatch over-credits rewards

medium

Zero-Liquidity Burns Incentive Budget

Ammplify

1,455.07 USDC • 8 total findings • Sherlock • maigadoh

high

Inclusive high index to OOB right key; wrong-range settlement & fee mis-accounting

high

chargeTrueFeeRate width-scaling mismatch undercharges takers & underpays makers

high

Missing subtreeBorrowedX/Y Propagation Undercharges Taker Fees and Underpays Makers

medium

Unintended JIT principal penalty via burnAsset mis-sequencing

medium

`ViewWalker.down` misassigns X-fee propagation for the right child

medium

MakerFacet.adjustMaker pays removed liquidity to msg.sender instead of the provided recipient

medium

PoolFacet Mint Callback Zero-Transfer Revert DoS

medium

Shift-Overflow in getEquivalentLiq Inflates LP Shares

Aug '25

USG - Tangent

8.78 USDC • 2 total findings • Sherlock • maigadoh

#60

high

Unauthorized Migration via Caller-Supplied ControlTower Parameter

medium

VsTAN.processRewards allows starting a new reward epoch while totalSupplyVsTan == 0

Neutrl Protocol

941.02 USDC • 1 total finding • Sherlock • maigadoh

medium

FULL-restricted addresses can bypass staking restrictions via `sNUSD.mint()` and `sNUSD.deposit()`

Yield Basis

114.27 USDC • 2 total findings • Sherlock • maigadoh

medium

Missing claimed update in claim() enables unlimited re-claims (full drain)

medium

Factory.set_gauge_controller asserts on the input parameter being zero instead of the contract state being unset

Jul '25

Malda

21.88 USDC • 1 total finding • Sherlock • maigadoh

#43

medium

EverclearBridge fails to pull tokens, locking funds in Rebalancer

Mellow Flexible Vaults

4.49 USDC • 2 total findings • Sherlock • maigadoh

#39

medium

logic in the ShareManager.updateChecks() function completely inverts the transfer whitelist enforcement

medium

DepositQueue Index Misuse Enables Vault-Wide DoS via Negative Fenwick Prefix

Jun '25

Symbiotic Relay

1,895.05 USDC • 2 total findings • Sherlock • maigadoh

medium

Unrestricted Operator Registration Leading to Gas-Based Denial of Service in VotingPowerProviderLogic.registerOperator()

medium

Whitelist Bypass in OperatorsWhitelist.sol Enables Unvetted Operators to Gain Voting Power