https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/57ac4d91-e48c-4767-91fd-1db551cb50da.jpg

shui

Security Researcher

Web3 Security researcher

Contact Me

High

Total

Medium

Total

$600.00

Total Earnings

#1457 All Time

8x

Payouts

3x

Top 25

4x

Top 50

All

Sherlock

Code4rena

Mar '25

Symmio, Staking and Vesting

0.00 USDC • 1 total finding • Sherlock • shui

#18

medium

Missing Access Control on notifyRewardAmount Function Allows Reward Rate Manipulation

Feb '25

Virtuals Protocol

51.11 USDC • 4 total findings • Code4rena • shui

#51

high

Lack of Access Control in `AgentNftV2::addValidator()` Enables Unauthorized Validator Injection and Causes Reward Accounting Inconsistencies

high

Public `ServiceNft::updateImpact` call leads to cascading issue

medium

Attacker can prevent user from executing application registered through `initFromToken()` in `AgentFactoryV4`.

medium

Missing Slippage Protection On Buy And Sell

Jan '25

IQ AI

243.25 USDC • 1 total finding • Code4rena • shui

#13

high

Adversary can win proposals with voting power as low as 4%

Plaza Finance

21.19 USDC • 3 total findings • Sherlock • shui

#68

high

Period Mismatch in Pool and Auction Contract Interaction

medium

Decimal Precision Mismatch in Market Rate Comparison Causes Incorrect Redemption Rates

medium

Users Can Claim Shares From Current Unfinished Period Due to Period Synchronization Issue

Nov '24

Ethos Network Financial Contracts

279.56 USDC • 2 total findings • Sherlock • shui

#16

high

Market Funds Incorrectly Include Protocol and Donation Fees Leading to Fail Withdrawal Graduated Market Funds

high

Increase Vouch includes Current Voucher in Reward Calculation

Aug '24

Winnables Raffles

5.17 USDC • 2 total findings • Sherlock • shui

#31

high

Attacker can DOS the creation of Raffles by exploiting the cancellation function

high

Incorrect track of lockedETH may cause lock of funds

Jul '24

TraitForge

0 USDC • 2 total findings • Code4rena • shui

#89

medium

Forger Entities can forge more times than intended

medium

Pause and unpause functions are inaccessible

Apr '24

Renzo

0 USDC • 1 total finding • Code4rena • shui

#58

high

Incorrect withdraw queue balance in TVL calculation