Senior Security Researcher
https://github.com/0xpessimist/portfolio
High
Total
Medium
Total Earnings
#381 All Time
Payouts
3rd Places
Top 10
Top 25
All
Sherlock
Code4rena
CodeHawks
Jan '25
1.98 USDC • 1 total finding • Sherlock • pessimist
#92
high
Backrunning `claimFees()` unfairly gives better rates
Aug '24
0.19 USDC • 1 total finding • CodeHawks • Ward
#20
medium
[H-01] Auction tokens will be lost forever when auction ends without bids
0.09 USDC • 3 total findings • CodeHawks • Ward
#153
Native token withdrawal fails until manually approved
Unnecessary balance checks and precision issues in TokenManager::_transfer
low
[Low-01] Missing Access Control in `CapitalPool::approve()` Function Allows any User to call it to set Allowance Amount `TokenContract` to `type(uint256).max`.
Jul '24
0 USDC • 1 total finding • Code4rena • Ward
#89
Pause and unpause functions are inaccessible
0 OP • Code4rena • Dup1337
#14
May '24
1,563.16 USDC • Code4rena • Dup1337
0 USDC • Code4rena • Dup1337
#10
Apr '24
14.58 USDC + NOYA stars • 3 total findings • Code4rena • Dup1337
`Keepers` does not implement EIP712 correctly on multiple occasions
Using the same heartbeat for multiple price feeds
Dust donation might DOS all connectors to create new holding positions, by preventing removing existing holding positions
828.08 USDC • 1 total finding • Code4rena • Dup1337
`PanopticFactory` uses spot price when deploying new pools, resulting in liquidity manipulation when minting
Mar '24
805.96 USDC • 1 total finding • Code4rena • Dup1337
#9
Freezed Chain will never be unfreeze since `StateTransitionManager::unfreezeChain` is calling `freezeDiamond` instead of `unfreezeDiamond`.
Feb '24
20,400.36 USDC • 2 total findings • Code4rena • Dup1337
User can erase their position debt for free
Borrowers can DoS liquidations by repaying as little as 1 share.
Jan '24
62.25 USDC • 2 total findings • Code4rena • Ward
#84
Chainlink price feed uses BTC, not WBTC. In case of depegging, oracles will become easier to manipulate.
Adversary can prevent updating price feed addresses by creating poisonous proposals ending in `_confirm`
5.79 USDC • Code4rena • Ward
#64
Dec '23
0.00 USDC • 1 total finding • CodeHawks • Ward
#105
Looping over unbounded `pendingStakes` array can lead to permanent DoS and frozen funds
304.35 USDC • 1 total finding • Code4rena • Ward
#21
Malicious delegatees can block delegators from redelegating and from sending their NFTs
1,477.2 USDC • 1 total finding • Code4rena • Ward
#12
No check for sequencer uptime can lead to dutch auctions failing or executing at bad prices