// 02 · AUDIT REPORTS
Reports
Public security reviews. Every finding listed here was confirmed with a proof of concept and re-verified after the fix.
Gas Bad NFT Marketplace Audit Report
Audit of a gas-optimized, assembly-based ERC-721 marketplace. NFTs sent directly to the marketplace are permanently locked, and buyItem credits msg.value instead of price, so buyer overpayment is silently captured by the seller.
MathMasters Audit Report
Audit of a fixed-point math library. mulWadUp computes the ceiling on the wrong value so the rounding error scales with input magnitude, and sqrt checks the wrong side of a right shift, returning incorrect roots.
Boss Bridge Security Audit Report
Audit of an L1<->L2 token bridge. Found that depositTokensToL2 accepts an arbitrary from address (draining any approver), withdrawal signatures can be replayed forever, and sendToL1 allows an operator-signed call to any target.
ThunderLoan Audit Report
Audit of an upgradeable flash-loan protocol. Found a storage collision that inflates the fee from 0.3% to 100% on upgrade, a manipulable TSwap spot-price oracle, and a deposit-instead-of-repay path that lets a borrower steal the loan.
T-Swap Audit Report
Audit of a constant-product AMM. The headline issue is that _swap hands out a free token every 10 swaps, silently draining liquidity providers and breaking the x * y = k invariant the protocol is built on.
SNARKeling Treasure Hunt Audit Report
Audit of a ZK (Noir) treasure-hunt protocol. A wrong variable in the "already claimed" check lets one valid proof drain the entire 100 ETH prize pool, and a duplicate hash in the allowed-treasure list permanently bricks one treasure.
President Elector: RankedChoice Audit
Audit of an on-chain ranked-choice voting system. Found broken EIP-712 signature verification (wrong typehash and array encoding) with no replay protection, plus a timing bug that lets an election be triggered immediately after deployment.
PuppyRaffle Audit Report
Audit of a raffle protocol. Found a reentrancy drain in refund(), weak block-based randomness in selectWinner(), an integer overflow in fee accounting, and a duplicate-check DoS in enterRaffle().
PasswordStore Initial Audit Report
Review of a single-user on-chain password store. Found that the "private" password is publicly readable from storage and that setPassword has no access control, letting anyone overwrite it.
0x00
No reports matched. The bug is elsewhere.