https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/b4b2322d-4a3d-48f5-9a4f-c42f1df944cc.jpg

thekmj

Literally a cat

Member of team PUSH0 with oot2k Audit contest results: 🥇x6, 🥈x2, 🥉x2 As judge: 7 I have a server now: discord.gg/uAUJshSXh9

Contact Me

High

Solo

Total

Medium

Total

$68.90K

Total Earnings

#120 All Time

26x

Payouts

2x

1st Places

1x

2nd Places

1x

3rd Places

All

Sherlock

Code4rena

Cantina

CodeHawks

Hats Finance

Feb '25

MetaLend Ronin Lending Protocol

Collaborative Audit • Sherlock • thekmj

Jan '25

napier-v2

47,408.34 USDC • 1 total finding • Cantina • thekmj

high

Finding not yet public.

Aave v3.3

439.92 USDC • Sherlock • thekmj

#50

Allora v0.8.0 Update

7,982.97 USDC • Sherlock • thekmj

Findings not publicly available for private contests.

Nov '24

Euro Dollar

4,900 USDC • 1 total finding • Hats • thekmj

high

`InvestToken`: Whitelisted investors can inflate USDE to infinity by arbitraging previous and current price differences

Oct '24

Avantis v1.5: Cross-Asset Leverage

699.35 OP • Sherlock • thekmj

#12

Findings not publicly available for private contests.

Sep '24

Royco Protocol

474.28 USDC • 3 total findings • Cantina • thekmj

#20

high

Finding not yet public.

high

Finding not yet public.

high

Finding not yet public.

Jul '24

MakerDAO Endgame

657.58 USDC • Sherlock • thekmj

#67

Mar '24

vVv Vesting & Staking

57.57 USDC • Sherlock • thekmj

#21

Jan '24

Salty.IO

69.54 USDC • 1 total finding • Code4rena • thekmj

#82

medium

Chainlink price feed uses BTC, not WBTC. In case of depegging, oracles will become easier to manipulate.

Dec '23

Footium Update

88.52 USDC • Sherlock • thekmj

#16

Oct '23

NextGen

109.14 USDC • Code4rena • thekmj

#56

Ethena Labs

6.46 USDC • Code4rena • thekmj

#39

ENS

1,846.79 USDC • 1 total finding • Code4rena • thekmj

medium

Some tokens enable the direct draining of all approved `ERC20Votes` tokens

Aug '23

Cooler Update

397.03 USDC • 1 total finding • Sherlock • thekmj

medium

`emergency_shutdown` role is not enough for emergency shutdown.

Sparkn

80.25 USDC • 4 total findings • CodeHawks • thekmj

#30

medium

Blacklisted STADIUM_ADDRESS address cause fund stuck in the contract forever

low

If a winner is blacklisted on any of the tokens they can't receive their funds

low

Potential DOS due to Gas Exhaustion Due to Large Array Iteration in `_distribute` Function

low

Using basis points for percentage is not precise enough for realistic use-cases

veRWA

186.84 USDC • 1 total finding • Code4rena • thekmj

#23

high

If governance removes a gauge, user's voting power for that gauge will be lost.

Jul '23

Beedle - Oracle free perpetual lending

17.98 USDC • 2 total findings • CodeHawks • thekmj

#132

high

Fee on transfer tokens will cause users to lose funds

gas

Use smaller data types for `lenderFee` and `borrowerFee` for better storage packing

Beam

78.49 USDC • Sherlock • thekmj

#24

Jun '23

Unitas Protocol

81.25 USDC • 1 total finding • Sherlock • thekmj

#18

medium

Protocol does not check for price staleness from the XOracle, which is problematic if the price feeder goes down.

May '23

Iron Bank

117.53 USDC • 2 total findings • Sherlock • thekmj

medium

PriceOracle will use the wrong price if the Chainlink registry returns price outside min/max range

medium

Chainlink oracle may return stale data

Venus Protocol Isolated Pools

1,202.71 USDC • 3 total findings • Code4rena • thekmj

#13

high

Incorrect `blocksPerYear` constant in `WhitepaperInterestRateModel`

medium

Exchange Rate can be manipulated

medium

Potential Unjust Liquidation After Exiting Market

Footium

0.01 USDC • 1 total finding • Sherlock • thekmj

#32

medium

Unsafe ERC20 transfer: tokens that don't revert on failed transfers may disable claims

Apr '23

Rubicon v2

699.75 USDC • 3 total findings • Code4rena • thekmj

#18

high

Placeholder

medium

Potential infinite loop in `_borrowLimit` function

medium

A liquidated position possibly cannot be closed

Jan '23

RabbitHole Quest Protocol contest

49.82 USDC • 2 total findings • Code4rena • thekmj

#44

high

Bad implementation in minter access control for `RabbitHoleReceipt` and `RabbitHoleTickets` contracts

medium

DOS risk if enough tokens are minted in Quest.claim can lead, at least, to transaction fee lost

Cooler

48.03 USDC • 2 total findings • Sherlock • thekmj

#27

high

Rollable loans can be indefinitely rolled, opening up room for a griefing attack that will permanently lock funds.

high

Unsafe ERC20 usage: If one of the token is a non-revert on transfer, the other token can be stolen.

Notional Update

1,204.75 USDC • 1 total finding • Sherlock • thekmj

high

`getEmergencySettlementBPTAmount()`: Wrong usage of `IERC20.totalSupply()` on BPT tokens