https://sherlock-files.ams3.digitaloceanspaces.com/profile_images/83d70ee5-9631-4e8f-841d-5e111ca99c2a.png

tinnohofficial

Security Researcher

Software developer and cybersecurity practitioner.

Contact Me

High

7

Total

Medium

1

Solo

6

Total

$8.71K

Total Earnings

#573 All Time

8x

Payouts

bronze

1x

3rd Places

regular

2x

Top 10

regular

5x

Top 25

All

Sherlock

CodeHawks

Jan '25

Plaza Finance

Plaza Finance

71.48 USDC • 4 total findings • Sherlock • tinnohofficial

#39

high

Incorrect Redemption Rate Applied to Leverage Tokens Due to Unconstrained Market Rate Check

high

Incorrect period used in `transferReserveToAuction` leads to complete failure of action system and loss of bidders' funds.

medium

USDC blacklist will permanently DOS the Auction contract affecting all users

medium

Users will receive incorrect redemption amounts due to decimal normalization error in market rate calculation

Ignite

Ignite

15.29 usdc • CodeHawks • tinnohofficial

#21

Dec '24

QuantAMM

QuantAMM

1,460.01 op • 4 total findings • CodeHawks • tinnohofficial

#10

high

Fee Evasion via LP Token Transfer Resets Deposit Value

medium

quantAMMSwapFeeTake used for both getQuantAMMSwapFeeTake and getQuantAMMUpliftFeeTake.

medium

Wrong Fee Take Function Called in UpliftOnlyExample Causing Incorrect Fee Distribution

low

Inconsistent timestamp storage when the LPNFT is transferred.

Sep '24

Liquid Staking

Liquid Staking

154.80 USDC • 1 total finding • CodeHawks • tinnohofficial

#30

low

Upgrade Initialization Logic Will Never Execute Due to Incorrect Initializer Usage in CommunityVCS

Staking

Staking

6,905.56 USDC • CodeHawks • tinnohofficial

bronze
Boost Core Incentive Protocol

Boost Core Incentive Protocol

74.73 USDC • 1 total finding • Sherlock • tinnohofficial

#19

medium

Insecure randomness leads to manipulation of the raffle winner in ERC20Incentive

Aug '24

Cork Protocol

Cork Protocol

3.41 USDC • 1 total finding • Sherlock • tinnohofficial

#17

medium

Incorrect implementation of the LVDepositNotPaused modifier

Tadle

Tadle

21.49 USDC • 6 total findings • CodeHawks • tinnohofficial

#83

high

Incorrect set up and logic of `referralInfoMap` in `SystemConfig::updateReferrerInfo` function

high

Native token withdrawal fails until manually approved

high

Malicious user can drain protocol by bypassing `ASK` offer abortion validation in `Turbo` mode

high

Token withdrawal fails until someone manually approves spending

low

[Low-01] Missing Access Control in `CapitalPool::approve()` Function Allows any User to call it to set Allowance Amount `TokenContract` to `type(uint256).max`.

low

3 `OfferStatus` are never used, and code seems to have contradicting intentions