https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/0ec84aed-7369-4fd5-8ee3-63470b29deb4.jpg

talfao

Security Researcher

I protect people's money on Ethereum and Starknet!

Contact Me

High

15

Total

Medium

4

Total

$2.24K

Total Earnings

#990 All Time

7x

Payouts

regular

1x

Top 10

regular

3x

Top 25

regular

4x

Top 50

All

Sherlock

Code4rena

CodeHawks

Jul '24

Velocimeter

Velocimeter

402.57 USDC • 4 total findings • Sherlock • talfao

#24

high

Pausing or killing the gauge leads to the stuck tokens inside the `Voter` contract.

high

Attacker Can Extend Token Lock Period Indefinitely with Minimal Cost in `Gauge`

high

`_checkpoint_total_supply()` Updates `ve_supply` for Incomplete Epochs

medium

`MINIMUM_LIQUIDITY` is wrong for stable pairs

Oct '23

NextGen

NextGen

2 USDC • 4 total findings • Code4rena • Talfao

#103

high

Attacker can drain all ETH from AuctionDemo when block.timestamp == auctionEndTime

high

Attacker can reenter to mint all the collection supply

high

Adversary can block `claimAuction()` due to push-strategy to transfer assets to multiple bidders

medium

Auction winner can prevent payments via `safeTransferFrom` callback

Real Wagmi #2

Real Wagmi #2

574.03 USDC • 2 total findings • Sherlock • talfao

#8

high

A burnt position will prevent repayment and liquidation

high

No slippage protection during repayment due to dynamic slippage params and easily influenced `slot0()`

Sep '23

DittoETH

DittoETH

198.74 USDC • 3 total findings • CodeHawks • talfao

#28

high

Users Lose Funds and Market Functionality Breaks When Market Reachs 65k Id

low

No check if bridge already exists

low

The protocol allows less flags to be generated than possible which could lead to a DoS of the primary liquidation process

Aug '23

Dopex

Dopex

0.07 USDC • 1 total finding • Code4rena • Talfao

#126

high

The peg stability module can be compromised by forcing lowerDepeg to revert.

Jul '23

CodeHawks Escrow Contract - Competition Details

CodeHawks Escrow Contract - Competition Details

37.94 USDC • 2 total findings • CodeHawks • talfao

#54

medium

High - Funds can be lost if any participant is blacklisted

low

Constructor of `Escrow` should make sure that `buyer`, `seller`, `arbiter` are different from each other.

Tokemak

Tokemak

1,023.97 USDC • 6 total findings • Sherlock • talfao

#21

high

Draining funds from Rewarder / Preventing users from withdrawing from LMPVault

high

Double spending issue in LMPRouter

high

Perform liquidations function always fails.

high

Loss rewards from Destination Vault rewarder due to positive slippage and other conditions

high

Double scaling of price filters in IncentivePricingStats.sol

medium

LMPVault is not entirely compliant with the ERC4626 standard.