Competition placements, published findings, and the original reports. All in one place.
| Competition | Platform | Accepted reports | Place |
|---|---|---|---|
| ENS 23 valid submissions (1 Chief, 22 duplicates) + 1 Insight | Immunefi | 17 Critical · 1 High · 4 Medium · 1 Low | 15th of 186 listed |
| Firelight | Immunefi | 2 High | 2nd |
| Quantus | Immunefi | 1 Critical · 1 High | 8th |
| Revert Finance StableSwap Hooks | Cantina | 1 High · 1 Medium | — |
| Metric | Sherlock | 3 Medium | — |
| Base Azul | Immunefi | 1 Medium | 53rd |
| Morpho Midnight | Cantina | 1 Low | — |
The ENS leaderboard credits 23 valid submissions: 1 Chief and 22 duplicates, plus 1 separate Insight. The 17 Critical-rated submissions are the highest Critical count among its 186 listed researchers. These counts include duplicates and do not represent unique vulnerabilities.
The Immunefi profile on 19 October 2026 shows Tradi3 as Top Ranked, 77th all time, with 28 accepted audit competition reports (17 Critical, 4 High, 5 Medium, 1 Low, 1 Insight) and $5,946 in displayed total earnings. These are Immunefi totals, not an all-platform total, and they include accepted duplicate reports. A dash means placement is not listed here.
ENS
Audit Competition | ENS
The ENS renewal route derives displayed ownership, expiry, and pricing from the ENSIP-15 normalized name while encoding the unnormalized URL label into renew(), letting a crafted link with an invisible character renew a lookalike name using the victim's funds.
Quantus
Audit Comp | Quantus
ReversibleTransactionExtension validates only the extrinsic call against the high-security whitelist and never inspects the transaction tip, allowing a signed whitelisted cancel() with an unbounded tip to drain the account's free balance at pre-dispatch.
Quantus
Audit Comp | Quantus
The first-party Quantus POS screen latches into Payment Received upon seeing a mempool import notification (txWatch_transfer), allowing a payer to usurp the invoice transaction with a same-nonce, higher-tip replacement before block inclusion.
Firelight
Audit Comp | Firelight
IncidentManager.approveCurrentAssessment(incidentId) binds only the incident ID in calldata and resolves currentAssessmentRoundId from mutable storage at execution, allowing a cancelled and replaced loss schedule to execute under the Risk Consortium's prior signature.
Firelight
Audit Comp | Firelight
CoverOrderAllocator computes current-period capacity from the vault's opening balance without reserving collateral still liable for unresolved previous-period claims, allowing a late period P-1 payout to drain the backing of settled period P cover.
Revert Finance
StableSwap Hooks
In Revert Finance's Uniswap v4 StableSwap Hooks, _handleRemoveLiquidityCallback() sends native ETH via poolManager.take() before decrementing reserves[] or burning LP shares, letting the receiver re-enter poolManager.swap() at stale deep-liquidity prices.
Metric
Metric
PriceVelocityGuardExtension.beforeSwap() overwrites lastMidPriceX64 on every accepted swap while keeping a full 1-block movement allowance when blockDiff == 0, allowing multiple same-block oracle updates interleaved with swaps to bypass the per-block velocity cap.
Metric
Metric
LazerConsumer._normalize() floors signed Pyth Lazer prices with exponents below -8 into integer E8 units before Q64 conversion, underpricing Base MOG/USD (exponent -10) by 5.48% and transferring 5.28% of one-sided LP principal to traders.
Metric
Metric
AnchoredPriceProvider quantizes two-feed synthetic ratios into integer E8 units via Math.mulDiv(mid, 1e8, mid2) before converting to Q64, flooring the live RSR/cbBTC ratio from 1.9198e-8 to 1e-8 and letting traders drain 47.83% of one-sided LP principal.
Base Azul
Audit Comp | Base Azul
Base Azul deploys AggregateVerifier with INTERMEDIATE_BLOCK_INTERVAL=30 (verifying a 1-root, 32-byte journal for 30-block challenges), while the official ZK prover service hardcodes DEFAULT_INTERMEDIATE_ROOT_INTERVAL=10 and commits to a 3-root, 96-byte journal.
Morpho Midnight
Morpho Midnight
MidnightBundles.buyWithAssetsTargetAndWithdrawCollateral() validates minUnits against raw pre-callback units returned by Midnight.take() before syncing the taker's position against same-transaction bad-debt liquidations triggered in the seller callback.
No reports match those filters. Try another search or clear the filters.
This archive contains 11 individual public findings. Competition totals may also include accepted reports without an individual entry here.