https://sherlock-files.ams3.digitaloceanspaces.com/twitter_images/7938d63b-bf61-4308-94a6-7e64f317db3f.jpg

wellbyt3

Security Researcher

grinding contests...

High

Total

Medium

Solo

Total

$6.63K

Total Earnings

#668 All Time

12x

Payouts

1x

2nd Places

3x

Top 10

9x

Top 25

All

Sherlock

Code4rena

CodeHawks

Feb '25

Liquidity Management

4,141.92 usdc • 5 total findings • CodeHawks • wellbyt3

high

Deposits on long one leverage vault don't actually finalize the flow, leading to a Denial of Service (DoS)

medium

PerpetualVault can be completely bricked

medium

Functions that rely on chainlink prices cannot be queried on avalanche due to sequencer uptime check.

medium

Fetching indexToken.balanceOf() will always revert for BTC market

low

Locked funds due to overflow via shares decimal scaling

Jan '25

Liquid Ron

0.02 USDC • 2 total findings • Code4rena • wellbyt3

#11

high

The calculation of `totalAssets()` could be wrong if `operatorFeeAmount` > 0, this can cause potential loss for the new depositors

medium

Incorrect Logic in onlyOperator Modifier Leading to Denial-of-Service for Authorized Operators Across Critical Functions

IQ AI

243.25 USDC • 1 total finding • Code4rena • wellbyt3

#13

high

Adversary can win proposals with voting power as low as 4%

Aave DIVA Wrapper

0.04 usdc • 1 total finding • CodeHawks • wellbyt3

low

Incorrect sequence of AaveDIVAWrapper constructor parameters

Plaza Finance

561.99 USDC • 3 total findings • Sherlock • wellbyt3

#19

high

Auctions can't be ended due to logical error

medium

Inconsistent `sharesPerToken` Usage Causes Incorrect Claim Amount

medium

DoS due to insufficient allowance in BalanceRouter.sol

Dec '24

Autonomint Colored Dollar V1

137.68 OP • 9 total findings • Sherlock • wellbyt3

#18

high

Strike price manipulation lets borrowers underpay for ETH upside

high

aBOND token holders never receive yields from liquidation

high

Lack of check allows borrowers to purchase options that never expire

high

Borrowers can renew expired options before withdrawal

high

USDT and USDa price parameters allow attacker to drain USDT from Treasury

high

Missing access controls bricks CDS deposits/withdraws and prevents liquidations

high

Misrouted cross chain message refund causes loss of funds and bricks liquidations

high

Type TWO liquidations don't update state allowing liquidated borrowers to withdraw

medium

Volatility parameter manipulation allows misspricing of options

Nov '24

Ethos Network Financial Contracts

72.48 USDC • 2 total findings • Sherlock • wellbyt3

#25

high

Overwithdrawal Due to Misaccounted Market Funds

high

Vote buyers get overcharged when a non-zero protocol fee is set

Project

757.71 USDC • 1 total finding • CodeHawks • wellbyt3

high

Missing KYC and NFT Ownership Verification for Ecosystem Access

Oct '24

AXION

83.85 USDC • 1 total finding • Sherlock • wellbyt3

#11

medium

USDT incompatible with IERC20Upgradeable(usd).approve()

Aug '24

ZeroLend One

442.30 USDC • 2 total findings • Sherlock • wellbyt3

#26

high

Logical error causes incorrect calculation of liquidityIndex and borrowIndex

medium

Supplying to vault DoS when underlying pools have capacity

Sentiment V2

2.37 USDC • 1 total finding • Sherlock • wellbyt3

#46

medium

Superpool owner can't pause deposits on Superpool

Tadle

188.80 USDC • 6 total findings • CodeHawks • wellbyt3

#31

high

Incorrect set up and logic of `referralInfoMap` in `SystemConfig::updateReferrerInfo` function

high

TokenManager - Unlimited withdraw

high

`DeliveryPlace::settleAskTaker` Has Incorrect Access Control

high

Token withdrawal fails until someone manually approves spending

high

Fund Withdrawal Flaw in preMarket Allows Users to Avoid Settlement Obligations

low

The referral bonus can't be split correctly between the referrer and the authority referral