https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/b39a62da-be9a-4126-a9c9-eae368e3081e.jpg

rsam_eth

Security Researcher

Blockchain security researcher - Github: https://t.co/fIKSA7D1aL - DM for solidity audits

Contact Me

High

24

Total

Medium

17

Total

$3.00K

Total Earnings

#898 All Time

15x

Payouts

gold

1x

1st Places

regular

3x

Top 10

regular

8x

Top 25

All

Sherlock

Code4rena

Feb '25

SEDA Protocol

SEDA Protocol

585.31 USDC • 4 total findings • Sherlock • rsam_eth

#11

high

Attacker can exploits batch sender role to block result Submissions via fee transfer reversion

high

`postBatch` lacks duplicate vote checks, allowing reuse of validator proofs and signatures

medium

Submitting requests could be prevented by front-running `postRequest` and submitting same exact request

medium

Attackers can flood solvers with thousands of requests and prevent fee payouts

Dec '24

SecondSwap

SecondSwap

204.91 USDC • 4 total findings • Code4rena • rouhsamad

#18

high

Users can claim more that their actual allotment

medium

Rounding error in stepDuration calculations.

medium

`buyFee` And `sellFee` Should Be Known Before Purchase

medium

Users can prevent being reallocated by listing to marketplace

Lambo.win

Lambo.win

607.23 USDC • 5 total findings • Code4rena • rouhsamad

#5

high

LamboFactory can be permanently DoS-ed due to createPair call reversal

high

Minting zero tokens when underlyingToken is not Ether in cashIn()

high

Calculation for `directionMask` is incorrect

medium

Since the cost of launching a new pool is minimal, an attacker can maliciously consume VirtualTokens.

medium

Attacker can captures `VETH-WETH` depeg profits through a malicious pool, rendering rebalancer useless if VETH Price > WETH Price

Nov '24

Nouns DAO - Auction Streams

Nouns DAO - Auction Streams

24.79 USDC • Sherlock • rsam_eth

#49

vVv Launchpad - Investments & Token distribution

vVv Launchpad - Investments & Token distribution

94.59 USDC • 1 total finding • Sherlock • rsam_eth

gold

high

VVVVCTokenDistributor::claim function doesn't authorize msg.sender resulting in theft of tokens by front-running

Aug '24

Winnables Raffles

Winnables Raffles

7.19 USDC • 2 total findings • Sherlock • rsam_eth

#28

high

Attacker can DOS raffle creation by canceling all `PRIZE_LOCKED` raffles using `WinnablesTicketManager::cancelRaffle`

high

`_sendCCIPMessage` function does not check `ccipDestAddress` and `ccipDestChainSelector` arguments allowing anyone to propagate winner to an arbitrary chain and PrizeManager

Jul '24

MagicSea - the native DEX on the IotaEVM

MagicSea - the native DEX on the IotaEVM

146.26 USDC • 6 total findings • Sherlock • rsam_eth

#22

high

Double voting using unlocked positions can occur every voting epoch

high

BribeRewarder uses wrong address to check owner of tokenId

high

BribeRewarder doesn't check whether current supply is zero resulting in some portion of rewards being lost

high

`BribeRewarder` calculates rewards incorrectly after entering a new epoch

medium

MlumStaking::_requireOnlyOperatorOrOwnerOf incorrectly assumes msg.sender to be the position owner allowing unauthorized modifications to a position

medium

Malicious `BribeRewarder`s with useless reward tokens can be created to fill rewarders of all voting epochs

May '24

Munchables

Munchables

28.82 USDC • 3 total findings • Code4rena • rouhsamad

#11

high

Malicious User can call `lockOnBehalf` repeatedly extend a users `unlockTime`, removing their ability to withdraw previously locked tokens

high

Invalid validation allows users to unlock early

medium

Players can gain more NFTs benefiting from that past remainder in subsequent locks

Feb '24

Althea Liquid Infrastructure

Althea Liquid Infrastructure

329.85 USDC • 3 total findings • Code4rena • rouhsamad

#9

high

Holders array can be manipulated by transferring or burning with amount 0, stealing rewards or bricking certain functions

medium

`LiquidInfrastructureERC20.sol` disapproved holders keep part of the supply, diluting approved holders revenue.

medium

Withdrawal from NFTs can be temporarily blocked

AI Arena

AI Arena

64.49 USDC • 2 total findings • Code4rena • rouhsamad

#82

high

A locked fighter can be transferred; leads to game server unable to commit transactions, and unstoppable fighters

high

Player can mint more fighter NFTs during claim of rewards by leveraging reentrancy on the `claimRewards() function `

Jan '24

Decent

Decent

806.42 USDC • 2 total findings • Code4rena • rouhsamad

#12

high

Users will lose their cross-chain transaction if the destination router do not have enough WETH reserves.

high

Anyone can update the address of the Router in the DcntEth contract to any address they would like to set.

Curves

Curves

0.6 USDC • 5 total findings • Code4rena • rouhsamad

#130

high

Unrestricted claiming of fees due to missing balance updates in `FeeSplitter`

high

Unauthorized Access to setCurves Function

medium

Protocol and referral fee would be permanently stuck in the Curves contract when selling a token

medium

onBalanceChange causes previously unclaimed rewards to be cleared

medium

Curves::_buyCurvesToken(), Excess of Eth received is not refunded back to the user.

Dec '23

Revolution Protocol

Revolution Protocol

51.14 USDC • 1 total finding • Code4rena • rouhsamad

#52

medium

`ERC20TokenEmitter::buyToken` function mints more tokens to users than it should do

Nov '23

Canto Application Specific Dollars and Bonding Curves for 1155s

Canto Application Specific Dollars and Bonding Curves for 1155s

1.37 USDC • 1 total finding • Code4rena • rouhsamad

#31

medium

No slippage protection for Market functions

Kelp DAO | rsETH

Kelp DAO | rsETH

43.45 USDC • 2 total findings • Code4rena • rouhsamad

#43

high

The price of rsEHT could be manipulated by the first staker

high

Protocol mints less rsETH on deposit than intended