function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2
require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded
sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale");
reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED);
merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds
flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check
require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1)
assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor();
IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338)
- cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only
mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner);
uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000
[PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external {
prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy");
+ require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17
forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap)
function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2
require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded
sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale");
reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED);
merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds
flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check
require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1)
assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor();
IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338)
- cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only
mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner);
uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000
function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2
require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded
sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale");
reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED);
merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds
flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check
require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1)
assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor();
IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338)
- cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only
mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner);
uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000
[PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external {
prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy");
+ require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17
forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap)
function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2
require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded
sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale");
reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED);
merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds
flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338) · - cf = reserve.collateralFactor; // no freshness check
require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only · mediation: MODIFY -> severity = CRITICAL (IMP-C1)
assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner); · uint256 cf = reserve.freshCollateralFactor();
IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000 · [PASS] test_exploit_drainsHealthyPosition() (gas: 412338)
- cf = reserve.collateralFactor; // no freshness check · require(cf.updatedAt > block.timestamp - 1 hours, "stale"); · reward = min(max(pct * fundsAtRisk, floor), cap) · function liquidate(address v, uint256 id) external { · prevHash <- headHash // append-only
mediation: MODIFY -> severity = CRITICAL (IMP-C1) · assert(obligation.ownershipTransferState == APPROVED); · merkleRoot = H(H(e1,e2), H(e3,e4)) // head 9c41e0…a7d2 · require(healthFactor(v) < 1e18, "healthy"); · + require(msg.sender == pendingOwner);
uint256 cf = reserve.freshCollateralFactor(); · IMP-C1 Critical direct theft of user funds · flashLoan(amount); _reenter(); _settle(); // guarded · sha256(payload) = 3f9a2b7c…c21e // event #17 · forge test --match-contract Vault --fuzz-runs 50000
Reputation, earned not bought
Researcher network
Ranked on verified impact alone: Critical and High findings a project confirmed, fixes proven by retest, and acknowledgements signed on the record. Volume earns nothing. Duplicates and good-faith misses never count against you.
- Researchers
- 0
- Crit + High
- 0
- Remediated
- 0
- Acknowledgements
- 0
Top of the network
#
Researcher
Proof score
Crit / High
Remediated
Acks
Contests
1
K
Kestreltrusted
Smart-contract auditor. Lending markets, bridges and anything with a liquidation engine.
49.5
3 / 0
3 · 75%
2
1 · best #3
2
L
lattice.ethverified
Formal methods + fuzzing. Oracle and AMM math.
20.5
0 / 2
1 · 50%
1
1 · best #2
3
IC
Ivy Chennew
Web3 security student. Recently started hunting.
11.5
0 / 1
1 · 100%
1
1 · best #4
4
M
marrowverified
Independent researcher. Cross-chain messaging and signature schemes.
10.5
0 / 1
0 · 0%
0
1 · best #1
5
D
deadbeefnew
@deadbeef
-15
0 / 0
—
0
1 · no award