The Contest Academy
Announcements, mentorship write-ups and deep dives into real vulnerabilities.
$10K in the first three months
A mentee who had earned $1K across the whole preceding year made ten times that in their first three months on the programme.
@0xfirefist, mentee
33bug deep dives
25mentorship videos
$10K+earned by mentees
450subscribers
$217Kin rewards dissected
Announcements
3 posts
Introducing The Mentorship Series1 December 2025
Introducing The Bug Deep Dive Series28 November 2025
Introducing The Contest Academy26 November 2025
Mentorship Series
26 posts
#26Pool ID packing end-to-end: collision loops, initialization guards and permissionless expand@0xfirefist · Panoptic · Code4rena · Video ↗15 January 2026
#25Simulating full accrue sequences: index desync and epochs versus block.timestamp@0xfirefist · Panoptic · Code4rena · Video ↗15 January 2026
#24What happens when the borrow index stops updating, and how far linear adaptation can run@0xfirefist · Panoptic · Code4rena · Video ↗15 January 2026
#23Precision in the trapezoidal borrow-rate curve, and the Yearn post-mortem behind it@0xfirefist · Panoptic · Code4rena · Video ↗15 January 2026
#22Downcasts that silently truncate, and gaming which branch accrueInterest takes@0xfirefist · Panoptic · Code4rena · Video ↗15 January 2026
#21Uniswap V4 mechanics: unlock callbacks, the sign of a delta, and sync before settle@0xfirefist · Panoptic · Code4rena · Video ↗15 January 2026
#20Clone-pattern immutable args: reading a calldata offset and shifting to the bytes you want@0xfirefist · Panoptic · Code4rena · Video ↗15 January 2026
#19Bit manipulation first: packing layouts, negative rounding, and unchecked blocks@0xfirefist · Panoptic · Code4rena · Video ↗15 January 2026
#18Starting a large codebase from its smallest files, and the OpenZeppelin multicall bug@0xfirefist · Panoptic · Code4rena · Video ↗15 January 2026
#17Writing the report: be specific, give examples, and do not let an LLM write it@0xfirefist · Mento V3 · Cantina · Video ↗17 December 2025
#16Making sure every last token can leave a strategy@0xfirefist · Mento V3 · Cantina · Video ↗17 December 2025
#15Doing the math on the whole rebalancing flow, not just the pool at the end of it@0xfirefist · Mento V3 · Cantina · Video ↗17 December 2025
#14Rounding always favours the protocol, and what mint does against a one-wei reserve@0xfirefist · Mento V3 · Cantina · Video ↗17 December 2025
#13Which side of a swap the fee is taken on, and whether it gets taken twice@0xfirefist · Mento V3 · Cantina · Video ↗17 December 2025
#12Division by a variable, oracle-priced pools, and trading limits split into small swaps@0xfirefist · Mento V3 · Cantina · Video ↗17 December 2025
#11Exhausting a flow before moving on, and who profits when the median moves@0xfirefist · Mento V3 · Cantina · Video ↗17 December 2025
#10Turning an out-of-scope root cause into an in-scope exploit@0xfirefist · Mento V3 · Cantina · Video ↗17 December 2025
#9Keeping a bad price out of storage: expired reports and permissionless cleanup@0xfirefist · Mento V3 · Cantina · Video ↗17 December 2025
#8Absurd Chainlink prices, weekend FX hours, and the breakers meant to catch both@0xfirefist · Mento V3 · Cantina · Video ↗17 December 2025
#7Know the collateral: which price feed it needs, and manual versus automatic shutdown@0xfirefist · Mento V3 · Cantina · Video ↗17 December 2025
#6Auditing a diff: rebuild it locally, note what you do not understand, then ask what it broke@0xfirefist · Mento V3 · Cantina · Video ↗17 December 2025
#5Closing out Sukukfi: call-sequence bugs and self-transfers that inflate a balance@0xfirefist · Sukukfi · Code4rena · Video ↗6 December 2025
#4Sponsor answers on the three-step vault: who eats a share price move, and why the delay exists@0xfirefist · Sukukfi · Code4rena · Video ↗6 December 2025
#3Pricing across asynchronous vault steps, and what to re-check when a function is spammed@0xfirefist · Sukukfi · Code4rena · Video ↗6 December 2025
#2Approaching a fresh codebase: base contracts first, then imports, inheritance and state@0xfirefist · Sukukfi · Code4rena · Video ↗6 December 2025
Bug Deep Dives
33 posts
#33LP pool cap may be exceeded on drawing settlementMegapot · Code4rena · Cap exceeded · $9542 · 2 dups · by montecristo18 January 2026
#32Factory deploy reverts instead of returning address when account already existsSequence · Code4rena · ERC4337 · $5882 · Unique · by pfapostol4 January 2026
#31Static signatures bound to caller revert under ERC-4337, causing DoSSequence · Code4rena · ERC4337 · $1416 · 3 Dups · by Agontuk3 January 2026
#30Partial signature replay/frontrunning attack on session callsSequence · Code4rena · Sig Replay · $19609 · Unique · by montecristo27 December 2025
#29Chained signature with checkpoint usage disabled can bypass all checkpointer validationSequence · Code4rena · Sig Replay · $19609 · Unique · by hgrano25 December 2025
#28The collateral that liquidators receive is valued below their initial expectations as a result of the price fallFAssets · Code4rena · Wrong Tracking · $33790 · Unique · by pashap999024 December 2025
#27Accumulated rewards in FSTO can be stolen by the agent's ownerFAssets · Code4rena · Wrong Tracking · $33790 · Unique · by pashap999023 December 2025
#26Vault owner is incentivized to not switch invalid collateral token during liquidationFAssets · Code4rena · Business Logic · $33790 · Unique · by rvierdiiev22 December 2025
#25Gas consumed in notifyUnsubscribe is underestimated during tests and is greater than 300,000 without pre-warmingBMX · Sherlock · Out of Gas · $2613 · Unique · by cergyk21 December 2025
#24ViewFacet.queryAssetBalances doesn't include uncollected uniswap fees for compounded maker positionAmmplify · Sherlock · Missing Logic · $886 · Unique · by panprog20 December 2025
#23View::queryAssetBalances does not account for JIT penaltiesAmmplify · Sherlock · Missing Logic · $886 · Unique · by tedox19 December 2025
#22The protocol doesnt support weird tokens like Tether Gold (that return false on every operation)Ammplify · Sherlock · Weird Token · $886 · Unique · by anonymousjoe18 December 2025
#21Liquidity borrowed from or repaid to parent nodes is not always minted or burned in the uniswap poolAmmplify · Sherlock · Accounting · $1196 · 3 dups · by panprog17 December 2025
#20User can lose all funds when creating or increasing compounded Maker position due to share inflationAmmplify · Sherlock · Inflation Attack · $1196 · 3 dups · by panprog16 December 2025
#19Borrow fee uses APY as per-second rate, causing extreme overchargingAmmplify · Sherlock · APY logic · $1196 · 3 dups · by blockace15 December 2025
#18Takers pay significantly higher fees than expected due to borrow amounts being split across segmentsAmmplify · Sherlock · Fee Logic · $4432 · Unique · by panprog14 December 2025
#17Incorrect inside fees calculation for uninitialized uniswap ticks causes positions funds being stuck in the contractAmmplify · Sherlock · Uniswap Fee Logic · $4432 · Unique · by panprog13 December 2025
#16All taker collateral and collected fees can be stolen by re-entering via RFTLib.settle to manipulate uniswap spot priceAmmplify · Sherlock · Spot Price Manipulation · $4432 · Unique · by panprog12 December 2025
#15Ineffective minimum order size check for ASK limit orders can lead to Denial of ServiceDango Dex · Sherlock · DoS · $1493 · 2 dups · by berndartmueller11 December 2025
#14XYK reflect_curve is incorrect and decreases K over time leading to loss of funds for LP providersDango Dex · Sherlock · Incorrect Math · $1493 · 2 dups · by haxagon10 December 2025
#13Price cannot be represented when a high-value base asset is quoted in a high-decimal assetDango Dex · Sherlock · Math Overflow · $3318 · Unique · by 0xShoonya9 December 2025
#12User can pause all auctions by overflow in mid-price averageDango Dex · Sherlock · Math Overflow · $3318 · Unique · by Ziusz8 December 2025
#11XYK reflect_curve omits swap fee in order sizing, leaking LP feesDango Dex · Sherlock · Business Logic · $1493 · 2 dups · by blockace6 December 2025
#10Asymmetric liquidity provision to geometric pool can allow attacker to purchase at flat oracle price, irrespective of trade sizeDango Dex · Sherlock · Business Logic · $4480 · 3 dups · by haxagon6 December 2025
#9Users can swap at the best price by splitting swap into several small swapDango Dex · Sherlock · Business Logic · $1633 · 6 dups · by ami5 December 2025
#8Incorrect rounding direction in geometric pool ask_exact_amount_out allows theft of fundsDango Dex · Sherlock · Incorrect Rounding · $7467 · 2 dups · by haxagon4 December 2025
#7Attackers will steal rewards from legitimate pools by making duplicate pools for listed tokenSuper DCA Liquidity Network · Sherlock · Incorrect Uniswap V4 understanding · 232 OP · 24 dups · by Kirkeelee3 December 2025
#6Unfair distribution of rewards for LPsSuper DCA Liquidity Network · Sherlock · Incorrect rewards distribution · 5661 OP · 2 dups · by vinica_boy2 December 2025
#5Foundation recall will inflate governance power for earnest votersSummer.fi · Sherlock · Wrong variable tracking · $381 · 14 dups · by Elroi1 December 2025
#4Satellite chains can't execute onlyGovernance functionsSummer.fi · Sherlock · Wrong Call Path · $5668 · 3 dups · by EgisSecurity30 November 2025
#3Lack of Emergency Market Invalidation MechanismIndex Fun Order Book · Sherlock · Wrong Business Logic · $720 · 5 dups · by 0xeix29 November 2025
#2PositionTokens violates one of the MUST rules defined in EIP-1155Index Fun Order Book · Sherlock · EIP-1155 compliance · $720 · 5 dups · by typicalHuman28 November 2025
#1Asymmetric fee structure allows market participants to get the same outcome for less feeIndex Fun Order Book · Sherlock · Swap fees · $5492 · Unique · by PUSH027 November 2025
Ready to secure your protocol?
Send the repo and scope for a quote within minutes.