https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/728660d1-9496-4400-b22f-e972febe70e2.jpg

pwnforce

Security Researcher

ZKP, Blockchain Security Researcher

Contact Me

High

Total

Medium

Total

$5.83K

Total Earnings

#731 All Time

10x

Payouts

1x

Top 10

6x

Top 25

7x

Top 50

All

Code4rena

Cantina

CodeHawks

Jan '25

farcasterattestation-monorepo

2,793.25 OP • 4 total findings • Cantina • pwnforce

high

Finding not yet public.

high

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

Nov '24

Concrete

363.25 USDC • Code4rena • pwnforce

#41

Oct '24

mev-commit

430.24 USDC • 2 total findings • Cantina • pwnforce

#22

high

Finding not yet public.

high

Finding not yet public.

Sep '24

symbioticfi-core

348.46 USDC • 1 total finding • Cantina • pwnforce

#11

medium

Finding not yet public.

Aug '24

Chakra

450.51 USDT • 6 total findings • Code4rena • pwnforce

#17

high

There is no refund mechanism in `ChakraSettlement.processCrossChainCallback` or `ChakraSettlementHandler.receive_cross_chain_callback` function

high

Anyone can manipulate user nonce (nonce_manager) in settlement contract

high

settlement.cairo doesn't process callback correctly leading to CrossChainMsgStatus marked as SUCCESS even if it failed on destination chain

high

In Starknet already processed messages can be re-submitted and by anyone

high

handler's `receive_cross_chain_callback()` will always set the tx_status to `SETTLED` on source chain & burn the tokens (MintBurn Mode) even when the msg fails on destination

medium

Does not check if to_chain and to_handler is whitelisted in cross_chain_erc20_settlement

zetachain-protocol

107.55 USDC • 3 total findings • Cantina • pwnforce

#60

high

Finding not yet public.

medium

Finding not yet public.

medium

Finding not yet public.

Jul '24

ArkProject: NFT Bridge

353.88 USDC • 2 total findings • CodeHawks • pwnforce

#25

high

The Bridging Process will revert if the Collection is matched on the destination chain and not matched on the source chain

medium

There is No `msg.value` check in `depositTokens`, causing potential token stuck

Jan '23

Popcorn contest

122.61 USDC • 1 total finding • Code4rena • pwnforce

#63

high

Modifier VaultController._verifyCreatorOrOwner does not work as intented

Astaria contest

850.06 USDC • 1 total finding • Code4rena • pwnforce

#18

medium

VAULT CAN BE CREATED FOR NOT-YET-EXISTING ERC20 TOKENS, WHICH ALLOWS ATTACKERS TO SET TRAPS TO STEAL NFTs FROM BORROWERS

Dec '22

Tigris Trade contest

13.76 USDC • 1 total finding • Code4rena • pwnforce

#61

medium

`_handleDeposit` and `_handleWithdraw` do not account for tokens with decimals higher than 18