Reports

Damn Vulnerable DeFi

Security reviews of the Damn Vulnerable DeFi v4 training challenges. Each challenge is audited as a standalone protocol, with every finding backed by a Foundry proof of concept.

11 challenge solutions →

Gas Bad NFT Marketplace Audit Report

Audit of a gas-optimized, assembly-based ERC-721 marketplace. NFTs sent directly to the marketplace are permanently locked, and buyItem credits msg.value instead of price, so buyer overpayment is silently captured by the seller.

MathMasters Audit Report

Audit of a fixed-point math library. mulWadUp computes the ceiling on the wrong value so the rounding error scales with input magnitude, and sqrt checks the wrong side of a right shift, returning incorrect roots.

Boss Bridge Security Audit Report

Audit of an L1<->L2 token bridge. Found that depositTokensToL2 accepts an arbitrary from address (draining any approver), withdrawal signatures can be replayed forever, and sendToL1 allows an operator-signed call to any target.

ThunderLoan Audit Report

Audit of an upgradeable flash-loan protocol. Found a storage collision that inflates the fee from 0.3% to 100% on upgrade, a manipulable TSwap spot-price oracle, and a deposit-instead-of-repay path that lets a borrower steal the loan.

T-Swap Audit Report

Audit of a constant-product AMM. The headline issue is that _swap hands out a free token every 10 swaps, silently draining liquidity providers and breaking the x * y = k invariant the protocol is built on.

SNARKeling Treasure Hunt Audit Report

Audit of a ZK (Noir) treasure-hunt protocol. A wrong variable in the "already claimed" check lets one valid proof drain the entire 100 ETH prize pool, and a duplicate hash in the allowed-treasure list permanently bricks one treasure.

President Elector: RankedChoice Audit

Audit of an on-chain ranked-choice voting system. Found broken EIP-712 signature verification (wrong typehash and array encoding) with no replay protection, plus a timing bug that lets an election be triggered immediately after deployment.

PuppyRaffle Audit Report

Audit of a raffle protocol. Found a reentrancy drain in refund(), weak block-based randomness in selectWinner(), an integer overflow in fee accounting, and a duplicate-check DoS in enterRaffle().

PasswordStore Initial Audit Report

Review of a single-user on-chain password store. Found that the "private" password is publicly readable from storage and that setPassword has no access control, letting anyone overwrite it.