qpzm

Security Researcher

Contact Me

High

Total

Medium

Total

$12.56K

Total Earnings

#461 All Time

30x

Payouts

8x

Top 10

15x

Top 25

25x

Top 50

All

Sherlock

Code4rena

Cantina

CodeHawks

Jan '25

Part 2

270.98 usdc • 3 total findings • CodeHawks • qpzm

#34

high

Vaults weth reward is not distributed correctly

medium

Incorrect weight assignment in Vault::updateVaultAndCreditDelegationWeight leads to overleveraging vault positions and insolvency

medium

Negative Credit Capacity Handling Causes Complete Vault Lockout When Underwater

reserve-index-dtf

53.43 USDC • 1 total finding • Cantina • qpzm

medium

Finding not yet public.

Oct '24

Avantis v1.5: Cross-Asset Leverage

1,589.44 OP • Sherlock • qpzm

#11

Findings not publicly available for private contests.

Jul '24

Zaros Part 1

439.12 USDC • 4 total findings • CodeHawks • qpzm

#19

high

`SettlementBranch._fillOrder` does not guarantee the collateral of a position is enough to pay the future liquidation fee.

high

Incorrect logic for checking isFillPriceValid

high

Wrong parameter passed in `TradingAccount::deductAccountMargin` function that results in excess margin withdrawal

low

Offchain orders are not cancelled after the account has been liquidated

TempleGold

10.75 USDC • 1 total finding • CodeHawks • qpzm

#38

low

Incosistent message generation in TempleTeleporter.quote() and TempleTeleporter.teleport() results in inaccurate required fee calculation by TempleTeleporter.quote()

CCIP v1.5

569.38 USDC • CodeHawks • qpzm

#10

May '24

Elfi

513.09 USDC • 4 total findings • Sherlock • qpzm

#10

high

`AccountFacet.batchUpdateAccountToken` has no access control

high

`AccountFacet.deposit` increases `initialMarginInUsdFromBalance` of cross positions more than the deposit amount.

high

`DecreasePositionProcess._updateDecreasePosition` calculates settledMargin in a wrong way when closing a cross position partially.

medium

`lossFee` is always 0 in `GasProcess.processExecutionFee`

Jan '24

Blast

2,630.23 USDC • 1 total finding • Cantina • qpzm

#43

medium

Finding not yet public.

Nov '23

Nouns Builder

21.94 USDC • 1 total finding • Sherlock • qpzm

high

`Token.updateFounders` does not delete the old founder's vesting schedule.

Kelp DAO | rsETH

4.66 USDC • 1 total finding • Code4rena • qpzm

#53

high

The price of rsEHT could be manipulated by the first staker

Oct '23

Ethena Labs

4.52 USDC • Code4rena • qpzm

#40

Aug '23

Dopex

336.13 USDC • 5 total findings • Code4rena • qpzm

#47

high

Improper precision of strike price calculation can result in broken protocol

high

Users can get immediate profit when deposit and redeem in `PerpetualAtlanticVaultLP`

medium

Inaccurate swap amount calculation in ReLP leads to stuck tokens and lost liquidity

medium

reLP() mintokenAAmount the calculations are wrong.

medium

User can avoid paying high premium price by correctly timing his bond call

Sparkn

648.69 USDC • 2 total findings • CodeHawks • qpzm

medium

The `digest` calculation in `deployProxyAndDistributeBySignature` does not follow EIP-712 specification

low

Signature missing nonce & expiration deadline

veRWA

43.21 USDC • 1 total finding • Code4rena • qpzm

#40

high

Delegated votes are locked when owner lock is expired

Tangible Caviar

81.68 USDC • Code4rena • qpzm

#51

Jul '23

Amphora Protocol

122.45 USDC • 1 total finding • Code4rena • qpzm

#17

high

Rounding error in `WUSDA` can result in loss of user funds, especially when manipulated by an attacker

Axelar Network

94.77 USDC • 1 total finding • Code4rena • qpzm

#22

medium

Proposal requiring native coin transfers cannot be executed

PoolTogether

504.75 USDC • 2 total findings • Code4rena • qpzm

#31

high

Delegated amounts can be forcefully removed from anyone in the TwabController

medium

IF THE UNDERLYING ASSET IS A FEE ON TRANSFER TOKEN IT COULD BREAK THE INTERNAL ACCOUNTING OF THE VAULT

Basin

986.09 USDC • 1 total finding • Code4rena • qpzm

medium

The constant product invariant can be broken.

Jun '23

Lybra Finance

1.32 USDC • 1 total finding • Code4rena • qpzm

#85

medium

Incorrect function call in LybraRETHVault's getAssetPrice

RealWagmi

1,566.97 USDC • 1 total finding • Sherlock • qpzm

high

`Dispatcher._estimateWithdrawalLp` miscalculates when swap direction is unbalanced.

Llama

25.63 USDC • Code4rena • qpzm

#24

Unitas Protocol

1,419.74 USDC • 1 total finding • Sherlock • qpzm

high

`XOracle` update is vulnerable to sandwich attack.

May '23

Iron Bank

0.08 USDC • 1 total finding • Sherlock • qpzm

#22

medium

`PriceOracle.getPriceFromChainlink` is not validated properly.

USSD - Autonomous Secure Dollar

48.80 USDC • 6 total findings • Sherlock • qpzm

#40

high

`DAIEthOracle` address is wrong.

high

`StableOracleDAI.getPriceUSD()` calculation is wrong.

high

`USSD.mintBalancer`, `USSD.burnBalancer` is public.

high

Invalid path 0x is passed to Uniswap Router in `USSDRebalancer.SellUSSDBuyCollateral()`

high

In `USSDRebalancer.BuyUSSDSellCollateral()`, the decimal of `amountToSellUnits` is 0.

high

`USSD.UniswapV3SwapInput()` is vulnerable to MEV sandwich attack.

Venus Protocol Isolated Pools

51.68 USDC • 1 total finding • Code4rena • qpzm

#43

medium

Exchange Rate can be manipulated

Footium

246.51 USDC • 1 total finding • Sherlock • qpzm

#15

medium

`FootiumAcademy.mintPlayers` may misinterpret an intermediate node as a leaf.

Apr '23

Frankencoin

22.6 USDC • Code4rena • qpzm

#66

Rubicon v2

6.46 USDC • 1 total finding • Code4rena • qpzm

#107

medium

Incorrect fee handling in Position.sol's Market Buy/Sell functions

Mar '23

Asymmetry contest

249.62 USDC • 1 total finding • Code4rena • qpzm

#26

high

Price of sfrxEth derivative is calculated incorrectly