thank_you

Security Researcher

Contact Me

High

Total

Medium

Total

$4.49K

Total Earnings

#779 All Time

15x

Payouts

1x

3rd Places

6x

Top 10

9x

Top 25

All

Sherlock

Code4rena

Apr '24

Zivoe

141.61 USDC • 1 total finding • Sherlock • thank_you

#41

medium

Borrower can escape paying last payment cycle interest

Mar '24

RadicalxChange

1.18 USDC • 1 total finding • Sherlock • thank_you

high

Bidders can cancel their own bid when they are the highest bidder

Zap Protocol

25.12 USDC • 2 total findings • Sherlock • thank_you

#10

high

Users can claim vested tokens more than once through re-entrancy

medium

Unable to update Vesting user deposits when token is represented as Ether

Revert Lend

2,564.06 USDC • 3 total findings • Code4rena • thank_you

high

`V3Vault.sol` permit signature does not check receiving token address is USDC

medium

Liquidation reward sent to msg.sender instead of recipient

medium

setReserveFactor fails to update global interest before updating reserve factor

Feb '24

Althea Liquid Infrastructure

80.56 USDC • 1 total finding • Code4rena • thank_you

#25

medium

`LiquidInfrastructureERC20.sol` disapproved holders keep part of the supply, diluting approved holders revenue.

AI Arena

0.14 USDC • 3 total findings • Code4rena • thank_you

#180

high

A locked fighter can be transferred; leads to game server unable to commit transactions, and unstoppable fighters

high

Non-transferable `GameItems` can be transferred with `GameItems::safeBatchTransferFrom(...)`

medium

Can mint NFT with the desired attributes by reverting transaction

Jan '24

Covalent

228.10 USDC • 2 total findings • Sherlock • thank_you

medium

Unstakings are never deleted leading to addValidatorAddress DOSing permanently

medium

OperationalStaking.stake() has no slippage checks

LooksRare YOLO

17.38 USDC • 1 total finding • Sherlock • thank_you

high

Anyone can participate in a future round for free

Curves

1.08 USDC • 1 total finding • Code4rena • thank_you

#129

high

Attack to make ````CurveSubject```` to be a ````HoneyPot````

Dec '23

Olas

358.73 USDC • 1 total finding • Code4rena • thank_you

#15

medium

Missing slippage protection in `liquidity_lockbox::withdraw`

DODO GSP

172.15 USDC • 1 total finding • Sherlock • thank_you

medium

First LP can DOS future LP stakers by withdrawing assets back to GSP contract

Ethereum Credit Guild

30.41 USDC • 1 total finding • Code4rena • thank_you

#81

medium

LendingTerm::debtCeiling() can return wrong debt as the min() is evaluated incorrectly

Aug '22

Foundation Drop contest

84.04 USDC • 1 total finding • Code4rena • thank_you

#28

medium

Possible to bypass saleConfig.limitPerAccount

Jan '22

Timeswap contest

766.73 USDC • 1 total finding • Code4rena • thank_you

#11

medium

XSS via SVG Construction contract

Nov '21

Malt Finance contest

20.04 USDC • 1 total finding • Code4rena • thank_you

#30

medium

Frontrunning in UniswapHandler calls to UniswapV2Router