Public findings & security reviews · Decentra Vision

Audit engagements, competition findings, and judging across EVM, SVM, Starknet, Substrate, and NEAR, with work in Rust, Solidity, Cairo, and Yul.

89 engagements · 10 judging assignments · 7 podium finishes

Engagements: Team · Solo
Findings: Code4rena · Cantina · Shieldify · Sherlock

Team Engagements

77 engagements · 2024–2026

Project links lead to public reports. Each engagement lists its start month, duration, provider, and language / platform.

2026

Project & scope	Engagement
Ondo Finance - GM Solana #2 RWAs, Token-2022, Minting & redemption, Signatures, Compliance, Rate limiting	2026-09 · 1.0 weeks Spearbit Rust / SVM
FactMachine - LMSR Prediction Market Prediction market, LMSR AMM, Liquidity provision, Position accounting, Settlement, Fee accounting	2026-09 · 1.0 weeks Zenith Rust / SVM
GMX - Builder Fee DEX, Perpetuals, Fee accounting, Order lifecycle, Transaction bundling	2026-09 · 0.4 weeks Zenith Rust / SVM
Interfold - Proof-backed Data Availability Data availability (Avail / VectorX), EIP-712 attestations, Ciphertext references, Public-key chunking	2026-09 · 0.6 weeks Zenith Solidity / EVM
Solomon Labs - Reserve-Backed Stablecoin Stablecoin, Token conversion, Settlement, Cross-chain, Token-2022, Fee & limit accounting	2026-08 · 2.4 weeks Zenith Rust / SVM
Altitude DP - Unit Core Stablecoin, Token conversion, Vault, Staking, Lending, Signatures	2026-08 · 0.4 weeks Zenith Solidity / EVM
Daimon DAO - Deflationary Governance Token Governance, Staking, Token migration, Reflection tokenomics, AMM, UUPS	2026-08 · 0.6 weeks Zenith Solidity / EVM
Interfold - Encrypted Execution Protocol Fully homomorphic encryption, ZK proofs, Node registry, Committee sortition, Staking, Slashing, Refunds	2026-07 · 2.6 weeks Zenith Solidity / EVM
GMX - Chainlink v11 Integration DEX, Perpetuals, Oracle, Position accounting, Open interest	2026-07 · 0.4 weeks Zenith Rust / SVM
Mantle - Fee Manager Stablecoin, Cross-chain, LayerZero, Payments, Fee accounting	2026-07 · 0.6 weeks Zenith Solidity / EVM
Jupiter - Program Fees Prediction market, Escrow, Fractional contracts, Settlement, Fee accounting	2026-07 · 0.4 weeks Zenith Rust / SVM
Nawa Finance - Stable ETH Vault Vault, Stablecoin, Private credit, Redemption queue, NAV oracle, UUPS	2026-07 · 0.6 weeks Oak Security Solidity / EVM
Scatter - Crypto Casino Crypto casino, Pinocchio, MagicBlock Ephemeral Rollups, VRF, Bankroll management, Game	2026-05 · 7.6 weeks Zenith Rust / SVM
Jupiter - Prediction Market Prediction market, Escrow, Fractional contracts, Refunds	2026-04 · 1.4 weeks Zenith Rust / SVM
Tezoro - Aggregator Vault, Yield aggregator, Rewards, AAVE, Compound, Fluid, Morpho	2026-04 · 1.7 weeks Oak Security Solidity / EVM
Mantle - Cross-chain Mint Bridge LayerZero, Jupiter, Cross-chain, Bridging, Fiat24	2026-03 · 1.0 weeks Zenith Rust / SVM, Solidity / EVM
Lightspeed - CLOB Rollup Rollup, Orderbook, Oracle, Spot, Perpetuals	2026-02 · 5.6 weeks Zenith Rust / Infrastructure
Moonbirds - BIRB Token Distributor Solidity / Rust LayerZero, OFT, NFT, Merkle proofs, Signatures	2026-01 · 1.4 weeks Zenith Rust / SVM, Solidity / EVM
Solomon Labs - Vault & Stake Vault, Staking, Stablecoin, Vesting	2026-01 · 1.0 weeks Spearbit Rust / SVM
0x - CrossChainReceiver (Update) Assembly, Signatures, Proxy, Multicall, Factory, ERC-2771	2026-01 · 0.8 weeks BailSec Yul / EVM, Solidity / EVM

2025

35 team engagements

Project & scope	Engagement
America.fun - AOL Staking Staking, Snapshot, Rewards	2025-12 · 1.0 weeks Zenith Rust / SVM
StarkWare Industries - Cairo Standard Library #2 Blake, Sha256, Poseidon, ECDSA, Arrays, Operators	2025-12 · 1.2 weeks Zenith Cairo / Starknet
Snowbridge Fiat Shamir Beefy (PR) Merkle proofs, Bitfields, Quorum	2025-12 · 0.4 weeks Oak Security Solidity / EVM
Ondo Finance - GM Solana Stablecoin, Swap, Compliance, Signatures	2025-11 · 2.0 weeks Spearbit Rust / SVM
Structured ERC20 Converter, ETH Wrapper, MaxBTC ERC20 for Eureka Bridge ERC-20, Token conversion	2025-11 · 0.4 weeks Oak Security Solidity / EVM
StarkWare Industries - Cairo Standard Library Math, Storage, Pointers, Types, Traits, Keccak, Secp256, Syscalls	2025-10 · 3.6 weeks Zenith Cairo / Starknet
Starknet Foundation - Alexandria Bytes Library Byte & bit manipulation, Arrays	2025-10 · 1.0 weeks Zenith Cairo / Starknet
GMX Solana - Liquidity Provider, Closed Markets DEX, Perpetuals, Staking	2025-09 · 2.4 weeks Zenith Rust / SVM
Meteora - Dynamic Staking Staking escrow, Permissioned/-less rewards	2025-09 · 1.6 weeks Zenith Rust / SVM
ForgeYields - Starknet Vault Kit Fund allocation, Merkle proofs, Vault, Call execution	2025-09 · 0.8 weeks Zenith Cairo / Starknet
Vesu v2 Lending, Pools, Factory	2025-08 · 1.0 weeks Zenith Cairo / Starknet
Vesu v1 - Upgrade Lending, Positions, Vault, Extensions, Hooks	2025-08 · 3.0 weeks Zenith Cairo / Starknet
Near One BTC Light Client Bitcoin, Litecoin, Dogecoin, Zcash, Client, Relay	2025-08 · 0.6 weeks AuditOne Rust / NEAR
Meteora - DLMM Concentrated liquidity market maker, Dynamic fees	2025-07 · 4.7 weeks Zenith Rust / SVM
Berachain - Reward Caps & Permit2 Vault, Reward rate limiting, Permit2	2025-06 · 0.6 weeks Zenith Solidity / EVM
Legion Upgrade Token generation (TGE), Vesting, Refunds	2025-06 · 0.4 weeks Zenith Rust / SVM
Meteora - Dynamic Bonding Curve & DAMMv2 (PRs) Token-2022, Access control	2025-06 · 0.2 weeks Zenith Rust / SVM
0x - CrossChainReceiver Assembly, Signatures, Proxy, Multicall, Permit2, ERC-7739	2025-06 · 0.6 weeks BailSec Yul / EVM, Solidity / EVM
Structured Private Deposit Jupiter Helper Perpetuals, Liquidity provision, Wrapper	2025-06 · 0.4 weeks Oak Security Rust / SVM
PolymerDAO - Solana Prover Contracts Cross-chain, Event proofs, Storage proofs	2025-06 · 1.4 weeks Spearbit Solidity / EVM, Rust / SVM
GMX Solana - Callback, Competition DEX, Perpetuals, CPI callbacks	2025-05 · 2.0 weeks Zenith Rust / SVM
MetaMask Card Baanx Withdraw Program Treasury, Batch transfers, Ed25519	2025-05 · 0.8 weeks Oak Security Solidity / EVM
Meteora - Dynamic Bonding Curve (PR) Rate limiting, CPI validation	2025-05 · 0.2 weeks Zenith Rust / SVM
Lombard Finance - Starknet LBTC Liquid BTC, Multi-signature, Cross-chain	2025-05 · 1.4 weeks Zenith Cairo / Starknet
Semantic Layer - SVF Uniswap v4 hooks, AI fund management, Staking	2025-04 · 0.8 weeks Spearbit Solidity / EVM
Blueberry Finance Hyperliquid, Escrow, Vault	2025-04 · 0.8 weeks Pashov Audit Group Solidity / EVM
Structured Private Deposit Contract Vault, WBTC, Whitelist	2025-04 · 0.6 weeks Oak Security Solidity / EVM
Crestal Network - Nation Contracts Bonding curve, Token distribution, Liquidity provision	2025-04 · 0.8 weeks Spearbit Solidity / EVM
Magic Labs - Newton Keystore Staking, Rewards, Airdrop, Checkpoints	2025-03 · 0.8 weeks Spearbit Solidity / EVM
Treehouse - Boring Vault Vault, Queue, CPI validation	2025-03 · 1.0 weeks Zenith Rust / SVM
Space and Time - SxT Node Proof of SQL, Node, Table indexing	2025-03 · 1.5 weeks Spearbit Rust / Substrate
Layer N - N1 Nord Block bridging, Merkle proofs	2025-03 · 0.8 weeks Spearbit Rust / SVM
GMX Solana DEX, Perpetuals	2025-01 · 6.0 weeks Zenith Rust / SVM
DefiTuna Concentrated liquidity, Leverage, Lending	2025-01 · 2.0 weeks Torii Security Rust / SVM
STIX OTC OTC, Escrow	2025-01 · 0.8 weeks Pashov Audit Group Solidity / EVM

2024

22 team engagements

Project & scope	Engagement
Near One OmniProtocol (PR) Cross-chain, Asset bridging	2024-12 · 2.0 weeks AuditOne Rust / NEAR
Nudge Token & Campaigns Reallocation marketplace, Rewards	2024-12 · 1.2 weeks Oak Security Solidity / EVM
ICN Link Token NFT ticket	2024-12 · 0.3 weeks Oak Security Solidity / EVM
Near One OmniProtocol Cross-chain, Asset bridging	2024-11 · 2.0 weeks AuditOne Rust / NEAR, Rust / SVM, Solidity / EVM
Zeitgeist Futarchy Combinatorial prediction markets	2024-11 · 2.5 weeks Oak Security Rust / Substrate
Push Protocol - Comm Cairo / Rust Cross-chain, Notifications	2024-11 · 1.0 weeks Oak Security Cairo / Starknet, Rust / SVM
BugHole Restaking Kaia chain, Restaking	2024-10 · 0.6 weeks Trust Security Solidity / EVM
Level Money Stablecoin, Restaking	2024-10 · 1.0 weeks Spearbit Solidity / EVM
Jupiter DEX, Aggregator	2024-10 · 0.4 weeks Code4rena Zenith Rust / SVM
4Real Finance Treasury, Staking, Yield	2024-10 · 0.8 weeks Code4rena Zenith Rust / SVM
Jupiter DEX, Aggregator	2024-10 · 0.3 weeks Code4rena Zenith Rust / SVM
Near One OmniBridge Cross-chain, Asset bridging	2024-10 · 2.0 weeks AuditOne Rust / NEAR, Solidity / EVM
Balancer V3 AMM, DEX, Vault	2024-09 · 4.0 weeks Spearbit Solidity / EVM
Resolv Stablecoin, Liquid staking, Futures	2024-08 · 1.0 weeks Pashov Audit Group Solidity / EVM
Aurora BTC Light Client Bitcoin client, Relay	2024-08 · 1.0 weeks AuditOne Rust / NEAR
Infrared Finance Proof of Liquidity, Staking, Voting	2024-07 · 3.0 weeks Spearbit Solidity / EVM
Router Protocol Cross-chain, Liquidity, Messaging	2024-06 · 3.0 weeks Oak Security Rust / SVM
Out GCC Tokenization, Marketplace	2024-06 · 1.0 weeks Oak Security Rust / SVM
Sharwa Finance Margin trading, Options	2024-06 · 1.0 weeks Pashov Audit Group Solidity / EVM
LayerZero ZROClaim Cross-chain, Airdrop	2024-06 · 0.4 weeks Pashov Audit Group Solidity / EVM
Pendle Finance Tokenization, Yield trading	2024-05 · 3.0 weeks Spearbit Solidity / EVM
Mythical Games Game, Infrastructure	2024-04 · 1.1 weeks Oak Security Rust / Substrate

Solo Engagements

12 engagements · 2024–2026

Project & scope	Engagement
Tailwind Zone - Clank Trade (Fee Hook) Uniswap v4 hooks, Fee accounting, ERC-6909	2026-10 · 0.4 weeks Decentra Vision Solidity / EVM
Tailwind Zone - Clank Trade Bonding curve, Token launchpad, Uniswap v4, Liquidity provision, Tokenized stocks, Fee accounting	2026-09 · 1.4 weeks Decentra Vision Solidity / EVM
Possum Finance (ref) Prediction markets, Vault, Staking	2025-12 · 0.8 weeks Decentra Vision Solidity / EVM
Possum TopCut Precision markets, Vault, Rewards	2025-06 · 0.6 weeks Decentra Vision Solidity / EVM
Yapster Contracts v3 Game, Vault, Rewards, Bonding curve	2025-02 · 0.5 weeks Decentra Vision Rust / SVM
Possum CyberCash Fee-on-transfer token, Migration	2025-02 · 0.4 weeks Decentra Vision Solidity / EVM
Yapster Contracts v2 Game, Vault, Rewards	2025-01 · 0.5 weeks Decentra Vision Rust / SVM
Term Structure TermMax Lending, Leveraged yield	2024-12 · 1.0 weeks Spearbit Solidity / EVM
Possum Core (ref) Governance, Staking	2024-07 · 0.8 weeks Decentra Vision Solidity / EVM
Proportionalized Contracts Fee token, Staking	2024-06 · 0.8 weeks Decentra Vision Solidity / EVM
Yeet Cup Game, Yield	2024-05 · 0.8 weeks Shieldify Solidity / EVM
Olas Lockbox v2 - Mitigation review Liquidity bonding	2024-03 · 0.4 weeks Cantina Rust / SVM

Back to top

---

Code4rena

Judging

• 2024-12: BendDAO Invitational (update audit)
• 2024-07: BendDAO Invitational
• 2024-05: Lavarage Appellate Court
• 2024-03: Neobase Invitational
• 2024-02: Code4rena Blue Bug Bounty submissions (undisclosed)
• 2024-02: UniStaker Infrastructure
• 2023-12: Revolution Protocol
• 2023-11: Canto Application Specific Dollars and Bonding Curves for 1155s
• 2023-10: The Wildcat Protocol

2024-03: Acala

Rust / Substrate

Risk	Finding
🟨 Medium	Incentive accumulation can be sandwiched with additional shares to gain advantage over long-term depositors Selected for report: M-02

2024-03: Canto Invitational 🥈

Risk	Finding
🟥 High	Native gas tokens can become stuck in ASDRouter contract Selected for report: H-01
🟥 High	Dual transaction nature of composed message transfer allows anyone to steal user funds Selected for report: H-02
🟨 Medium	Removing token from the whitelist may cause DoS due to limited USDC amount
🟦 Low	Low Risk and Non-Critical Issues Selected for report: QA

2024-03: Phat Contract Runtime 🥉

Rust / Substrate

Risk	Finding
🟨 Medium	Limited availability of balance_of(...) method Selected for report: M-01

Placement announcement

Awards have been announced for the $60,500 USDC @PhalaNetwork audit! 🥳

Top 5:
🥇 @DadeKuma - $15,937.95 USDC
🥈 zhaojie - $15,225.87 USDC
🥉 @MarioPoneder - $12,619.42 USDC
🏅 Koolex - $2,606.45 USDC
🏅 Cryptor - $994.09 USDC pic.twitter.com/C15fmXxxJ2

— Code4rena (@code4rena) April 1, 2024

2024-01: Opus 🥉

Cairo / Starknet

Risk	Finding
🟨 Medium	Collateral cannot be withdrawn from trove once yang is suspended Selected for report: M-07
🟨 Medium	Unhealthy troves with LTV > 90% cannot always be absorbed as intended Selected for report: M-09
🟦 Low	Low Risk and Non-Critical Issues Selected for report: QA

Placement announcement

Rounding out the Top 3 was @MarioPoneder! 🥉

Rank: #3 (#86 All-time)
Medium-risk findings: 2 (2 solo) pic.twitter.com/vCgs0GlnQY

— Code4rena (@code4rena) March 6, 2024

2023 · 16 Code4rena competitions

2023-12: Olas

Risk	Finding
🟥 High	Bonds created in year cross epoch’s can lead to lost payouts

2023-10: zkSync Era

Risk	Finding
🟨 Medium	Incorrect max precompile address
🟦 Low	EIP-1559 transactions can be invoked from kernel space accounts due to missing assertion in bootloader
🟦 Low	EIP-712 transactions via custom accounts do not comply with EIP-3607 and could therefore fail
🟦 Low	State changes are preserved on failed L2 transactions using custom account abstraction
🟦 Low	Users can avoid paying fees for failed L2 transactions

2023-09: Maia DAO - Ulysses

Risk	Finding
🟥 High	All tokens can be stolen from VirtualAccount due to missing access modifier Selected for report: H-01

2023-09: Venus Prime

Risk	Finding
🟥 High	Prime contract incompatible with currently deployed / active markets (vToken) with 8 decimals
🟥 High	Prime contract incompatible with underlying assets differing from 18 decimals

2023-08: Chainlink Staking v0.2

Findings under NDA, requires Code4rena backstage access.

Risk	Finding
🟨 Medium	#223

2023-08: Dopex

Risk	Finding
🟨 Medium	Change of fundingDuration causes "time travel" of PerpetualAtlanticVault.nextFundingPaymentTimestamp() Selected for report: M-10
🟦 Low	RdpxV2Core.removeAssetFromtokenReserves(...) irrecoverably breaks reserve token handling

2023-08: Arbitrum Security Council Election System

Risk	Finding
🟨 Medium	SecurityCouncilNomineeElectionGovernorTiming.electionToTimestamp(...) can create unsupported/invalid dates

2023-07: Tapioca DAO

Risk	Finding
🟥 High	User can give himself approval for all assets held by MagnetarV2 contract Selected for report: H-49
🟥 High	MagnetarMarketModule.depositRepayAndRemoveCollateralFromMarket(...) can be invoked with other user's tokens
🟨 Medium	Double accounting of action value in MagnetarV2.burst(...)
🟦 Low	Multicall3 ignores allowFailure leading to DoS

2023-07: Axelar Network

Risk	Finding
🟨 Medium	Insufficient support for tokens with different decimals on different chains lead to loss of funds on cross-chain bridging Selected for report: M-08

2023-05: Maia DAO Ecosystem

Risk	Finding
🟥 High	UlyssesToken asset ID accounting error Selected for report: H-25
🟥 High	Ulysses Omnichain support for tokens with other than 18 decimals is fundamentally flawed
🟨 Medium	RootBridgeAgent.redeemSettlement can be front-run using RootBridgeAgent.retrySettlement causing redeem DoS Selected for report: M-03
🟨 Medium	Maia Governance token balance dilution in vMaia vault is breaking the conversion rate mechanism Selected for report: M-22
🟨 Medium	Claiming outstanding utility tokens from vMaia vault DoS on pbHermes<>bHermes conversion rate > 1 Selected for report: M-23
🟨 Medium	UlyssesToken.setWeights(...) can cause user loss of assets on vault deposits/withdrawals Selected for report: M-34
🟨 Medium	Withdrawal from vMaia vault only on first Tuesday of the month is not strictly enforced
🟦 Low	Payable method RootBridgeAgent.retrySettlement can lead to loss of funds for users

2023-05: Chainlink Cross-Chain Services: CCIP and ARM Network

Findings under NDA, requires Code4rena backstage access.

Risk	Finding
🟥 High	#164
🟨 Medium	#95
🟨 Medium	#307

2023-05: Ajna Protocol

Risk	Finding
🟥 High	Position NFT can be spammed with insignificant positions by anyone until rewards DoS Selected for report: H-03
🟥 High	Permanent loss of rewards on temporary underfunding of RewardsManager contract

2023-04: EigenLayer 🥇

Risk	Finding
🟥 High	Slot and block number proofs not required for verification of withdrawal (multiple withdrawals possible) Selected for report: H-01

Placement announcement

Awards have been announced for the $90,500 USDC @eigenlayer audit 🤝

Top 5:
🥇 @MarioPoneder - $13,081.90 USDC
🥈 volodya - $12,193.66 USDC
🥉 windowhan001 - $5,031.50 USDC
🏅 @CyfrinAudits - $3,177.34 USDC
🏅 @QiuhaoLi - $2,972.95 USDC

— Code4rena (@code4rena) June 10, 2023

2023-04: Rubicon v2

Findings under NDA, requires Code4rena backstage access.

Risk	Finding
🟥 High	#1214
🟥 High	#1265

2023-04: Caviar Private Pools

Risk	Finding
🟥 High	Owner of PrivatePool can steal any NFTs and tokens that the pool has approval for
🟨 Medium	PrivatePool creation can be front-run

2023-02: Ethos Reserve

Risk	Finding
🟨 Medium	Strategy emergency exit (guardian privileges) harvest amount can be reduced with strategist privileges
🟨 Medium	Inconsistent support of ERC20 tokens that deduct transaction fee
🟦 Low	Strategy contract upgrade can be prevented by lower privileged roles

Back to top

---

Cantina

Finding details may require signing in to Cantina.

Judging

• 2024-09: Centrifuge

2024-02: 3DNS

Risk	Finding
🟥 High	Anyone can drain the whole ETH balance of ThreeDNSRegControl when making a commitment
🟨 Medium	Safe transfers of registrations to ERC-721 receiver contracts which also have a fallback method will always fail
🟨 Medium	Batch transfers of registrations to contracts will always fail due to an invalid selector check

2024-01: Olas Lockbox 🥈

Rust / SVM

Risk	Finding
🟨 Medium	Attacker can create token account for NFT position to cause deposit DoS
🟨 Medium	DoS on simultaneous deposit due to id restriction
🟦 Low	Missing mutable constraint leads to withdrawal DoS due to read-only signer
🟦 Low	Attacker can frontrun lockbox initialization to provide own fee token accounts

Placement announcement

Congratulations to our resident rustaceans on an excellent job during the @autonolas security competition.

Here are your top 3 placements:

🥇: @99crits - $22,275.61
🥈: @MarioPoneder - $8,590.35
🥉: @meltedblocks - $6,682.68

Full Results Below! pic.twitter.com/Cr5ATXONbQ

— Cantina 🪐 (@cantinaxyz) March 18, 2024

2023-11: Superform

Risk	Finding
🟨 Medium	Insufficient support for fee-on-transfer tokens
🟦 Low	ArrayCastLib.castToMultiVaultData(...) does not preserve values of hasDstSwap and retain4626
🟦 Low	Timing overlap of dispute/finalizeRescueFailedDeposits(...) methods

2023-11: Morpho Blue

Risk	Finding
🟦 Low	Interest/fee accrual can be suppressed in regular markets with low-decimal loan tokens
🟦 Low	Oracles should be whitelisted to avoid theft by direct price manipulation

---

Shieldify

2024-03: Possum Labs Portals v2 🥈

Risk	Finding
🟨 Medium	Investors could earn 10x more than intended Finding in report: M-01
🟦 Low	Cannot revoke permit of MintBurnToken Finding in report: L-02

2024-02: Ion Protocol 🥇

Risk	Finding
🟨 Medium	Unsafe downcast truncation in UniswapOracleLibrary leading to invalid price data Finding in report: M-01

---

Sherlock

Note that I am also listing issues here which were labeled as Excluded due to the strict High/Medium only policy at Sherlock.

However, those issues are still valid & valuable for the sponsor and most of them contain a coded PoC, therefore they might be a good read for new aspiring auditors.

2023-07: Perennial V2

Risk	Finding
🟦 Low	DSU token balance of MultiInvoker contract can be drained by anyone

2023-06: Tokemak

Risk	Finding
🟥 High	Rewards can be drained due to incorrect handling of userRewardPerTokenPaid accounting
🟥 High	LiquidationRow.liquidateVaultsForToken(...) will always revert due to missing token transfers
🟦 Low	LMPVaultRouter mint and deposit entry-points can be blocked by anyone

2023-06: Index Update

Risk	Finding
🟦 Low	New auction rebalance can be started before previous one concluded or duration elapsed
🟦 Low	Insufficient validation of auction execution price adapter config data
🟦 Low	SetToken can be indefinitely locked by AuctionRebalanceModule

---

Back to top · More about my work