Security practice
Audits & findings
A concise view of competition placements, recorded impact, and representative public findings.
9×first-place finishes
10+Secure3 Top 3 finishes
24Top-20 public placements
414recorded H/M findings
27 recorded public competition results
View competition archive ↗
Finding record
High / Critical + Medium| Category | High / Critical | Medium | Total |
|---|---|---|---|
| Public competitions | 34 | 72 | 106 |
| Secure3 | 4 | 20 | 24 |
| Private engagements | 92 | 192 | 284 |
| Total recorded | 130 | 284 | 414 |
Selected public findings
Evidence linked
01Velvet — share manipulation via liquidity inflationUnderlying Uniswap V3 liquidity can distort position-token share issuance.Solo
Contest 02Royco — reward-rate manipulationCampaign extension close to expiry redistributes value between participants.Solo
Contest 03Velvet — hash collision in token bit-position mappingModulo mapping assigns multiple assets to the same token-tracking position.Public
Contest 04Royco — unauthorized IP can create fake ordersA missing authorization boundary permits ineligible order creation.Public
Contest 05Arcade.xyz — lender loss on immediate repaymentNo minimum repayment period means intended lender economics can be bypassed.Solo
Contest 06Coinbase EIP-7702 — signatures never expireA signed implementation update remains executable indefinitely.Public
Contest
Contest 02Royco — reward-rate manipulationCampaign extension close to expiry redistributes value between participants.Solo
Contest 03Velvet — hash collision in token bit-position mappingModulo mapping assigns multiple assets to the same token-tracking position.Public
Contest 04Royco — unauthorized IP can create fake ordersA missing authorization boundary permits ineligible order creation.Public
Contest 05Arcade.xyz — lender loss on immediate repaymentNo minimum repayment period means intended lender economics can be bypassed.Solo
Contest 06Coinbase EIP-7702 — signatures never expireA signed implementation update remains executable indefinitely.Public
Contest
Need a security review?
Whether you're building a protocol or coordinating an audit team, send the scope, stack, repository or documentation, and target timeline by email ↗ or Telegram ↗.