Identifying and mitigating vulnerabilities in decentralized protocols before they hit mainnet.
I’m M3dython, a specialized Blockchain Security Researcher focused on DeFi protocol architecture. I actively compete in top-tier audit contests like Sherlock, where I’ve earned recognition for identifying High/Critical vulnerabilities in complex financial logic.
My mission is to help projects scale securely. I bridge the gap between raw code and business logic to prevent treasury-draining exploits.
- 🔭 Focus: Advanced smart contract security patterns & auditing.
- 🌱 Learning: Solidity Fuzzing (Foundry/Echidna) and Formal Verification.
- 🛡️ Services: Available for private audits and consultation.
- ⚡ Fun fact: I find uncovering subtle logical flaws in Web3 protocols incredibly rewarding.
Primary Platform: Sherlock Profile
| Contest | High | Medium | Report | Rank |
|---|---|---|---|---|
| LEND (May '25) | 4 | 1 | Read Report | 52nd |
| Burve (Apr '25) | 3 | - | Read Report | 8th |
| PinLink RWA (Mar '25) | - | - | Read Report | 39th |
| Yieldoor (Feb '25) | 1 | 1 | Read Report | 15th |
📂 Click to expand specific vulnerability details
- Finding 1: CrossChainRouter uses incorrect collateral/token data during cross-chain liquidations, disrupting repayment logic.
- Finding 2:
_checkLiquidationValidlogic flaw allows unfair liquidations or prevents valid ones. - Finding 3: Interest logic in
borrowWithInterestunderstates cross-chain debt, risking insolvency. - Finding 4: CoreRouter prone to fund depletion due to miscalculated redemption payouts.
- Finding 5: Liquidators may under-liquidate positions due to
maxCloseusing incomplete accrued balances.
- Finding 1: Zero Tax Exploitation mechanism found in Withdrawal Function.
- Finding 2: Internal vs External vault share mismatch potentially traps user funds.
- Finding 3: Critical: ERC4626 inflation attack vector identified on underlying vault.
- Finding: Centralized Oracle updates vulnerable to front-running, causing user payout loss.
- Finding 1: Uninitialized
feeRecipientdiverts protocol fees to zero address (revenue loss). - Finding 2: Calculation error impacts leveraged position holders.
- Damn Vulnerable DeFi Solutions: My personal write-ups and solutions for the DVD wargame. View Repository
© 2025 M3dython. Open for audits and collaboration.