twicek

Hi! twicek here 👋

I'm a security researcher, you can reach me at [email protected] or DM me on Twitter @twicek_k.

You can find examples of previous auditing work below.

Project	Findings	Severity
Undisclosed	Griefing	Medium
Undisclosed	Uninitialized critical variable	Low

Contest	Findings
Union Finance V2 (First one)	1. UserManager.updateFrozenInfo cannot be called from UToken
Union Finance V2 (Second one)	1. cancelVouch doesn't update the voucher index of the last vouch of a borrower properly (2nd place)
OpenQ	1. Funders can deny rewards to last claimants by calling refundDeposit between tiers claims 2. refundDeposit function can be DoS by an unbounded loop in getLockedFunds
Fair funding (Vyper)	1. The auction can be started by anyone calling settle before start_auction is called by the owner
Opyn	1. Anyone in the order queue wanting to withdraw or deposit can grief the auction by making withdrawAuction or depositAuction always revert
Y2K	1. ownerToRollOverQueueIndex is incorrectly updated when a user call enlistInRollover twice 2. Increasing the relayerFee create a risk for relayers 3. After having roll over once a user will not be able to roll over again 4. Queued deposits can get stuck indefinitely in the deposit queue
Redacted Cartel	1. A malicious early user/attacker can manipulate the pxGmx's pricePerShare to take an unfair share of future user's deposits
Escher	1. Users can lose funds if they call buy with _amount larger than type(uint48).max 2. If very few NFTs have been sold saleReceiver will have to buy all remaining NFT to retrieve the contract funds