# The Contest Academy — 0xSimao

> Announcements, mentorship write-ups and deep dives into real vulnerabilities.

- **33** bug deep dives
- **25** mentorship videos
- **$10K+** earned by mentees
- **450** subscribers
- **$217K** in rewards dissected

**$10K in the first three months** — A mentee who had earned $1K across the whole preceding year made ten times that in their first three months on the programme. (@0xfirefist, mentee)

Every post below is a page of its own, and the same post in Markdown at that address with `.md` on the end.

## Announcements

3 posts.

- [Introducing The Mentorship Series](https://0xsimao.com/the-contest-academy/introducing-the-mentorship-series) — 1 December 2025
- [Introducing The Bug Deep Dive Series](https://0xsimao.com/the-contest-academy/introducing-the-bug-deep-dive-series) — 28 November 2025
- [Introducing The Contest Academy](https://0xsimao.com/the-contest-academy/introducing-the-contest-academy) — 26 November 2025

## Mentorship Series

26 posts.

- [Pool ID packing end-to-end: collision loops, initialization guards and permissionless expand](https://0xsimao.com/the-contest-academy/mentorship-series-26) — Mentorship Series #26 · 15 January 2026 · @0xfirefist · Panoptic · Code4rena
- [Simulating full accrue sequences: index desync and epochs versus block.timestamp](https://0xsimao.com/the-contest-academy/mentorship-series-25) — Mentorship Series #25 · 15 January 2026 · @0xfirefist · Panoptic · Code4rena
- [What happens when the borrow index stops updating, and how far linear adaptation can run](https://0xsimao.com/the-contest-academy/mentorship-series-24) — Mentorship Series #24 · 15 January 2026 · @0xfirefist · Panoptic · Code4rena
- [Precision in the trapezoidal borrow-rate curve, and the Yearn post-mortem behind it](https://0xsimao.com/the-contest-academy/mentorship-series-23) — Mentorship Series #23 · 15 January 2026 · @0xfirefist · Panoptic · Code4rena
- [Downcasts that silently truncate, and gaming which branch accrueInterest takes](https://0xsimao.com/the-contest-academy/mentorship-series-22) — Mentorship Series #22 · 15 January 2026 · @0xfirefist · Panoptic · Code4rena
- [Uniswap V4 mechanics: unlock callbacks, the sign of a delta, and sync before settle](https://0xsimao.com/the-contest-academy/mentorship-series-21) — Mentorship Series #21 · 15 January 2026 · @0xfirefist · Panoptic · Code4rena
- [Clone-pattern immutable args: reading a calldata offset and shifting to the bytes you want](https://0xsimao.com/the-contest-academy/mentorship-series-20) — Mentorship Series #20 · 15 January 2026 · @0xfirefist · Panoptic · Code4rena
- [Bit manipulation first: packing layouts, negative rounding, and unchecked blocks](https://0xsimao.com/the-contest-academy/mentorship-series-19) — Mentorship Series #19 · 15 January 2026 · @0xfirefist · Panoptic · Code4rena
- [Starting a large codebase from its smallest files, and the OpenZeppelin multicall bug](https://0xsimao.com/the-contest-academy/mentorship-series-18) — Mentorship Series #18 · 15 January 2026 · @0xfirefist · Panoptic · Code4rena
- [Writing the report: be specific, give examples, and do not let an LLM write it](https://0xsimao.com/the-contest-academy/mentorship-series-17) — Mentorship Series #17 · 17 December 2025 · @0xfirefist · Mento V3 · Cantina
- [Making sure every last token can leave a strategy](https://0xsimao.com/the-contest-academy/mentorship-series-16) — Mentorship Series #16 · 17 December 2025 · @0xfirefist · Mento V3 · Cantina
- [Doing the math on the whole rebalancing flow, not just the pool at the end of it](https://0xsimao.com/the-contest-academy/mentorship-series-15) — Mentorship Series #15 · 17 December 2025 · @0xfirefist · Mento V3 · Cantina
- [Rounding always favours the protocol, and what mint does against a one-wei reserve](https://0xsimao.com/the-contest-academy/mentorship-series-14) — Mentorship Series #14 · 17 December 2025 · @0xfirefist · Mento V3 · Cantina
- [Which side of a swap the fee is taken on, and whether it gets taken twice](https://0xsimao.com/the-contest-academy/mentorship-series-13) — Mentorship Series #13 · 17 December 2025 · @0xfirefist · Mento V3 · Cantina
- [Division by a variable, oracle-priced pools, and trading limits split into small swaps](https://0xsimao.com/the-contest-academy/mentorship-series-12) — Mentorship Series #12 · 17 December 2025 · @0xfirefist · Mento V3 · Cantina
- [Exhausting a flow before moving on, and who profits when the median moves](https://0xsimao.com/the-contest-academy/mentorship-series-11) — Mentorship Series #11 · 17 December 2025 · @0xfirefist · Mento V3 · Cantina
- [Turning an out-of-scope root cause into an in-scope exploit](https://0xsimao.com/the-contest-academy/mentorship-series-10) — Mentorship Series #10 · 17 December 2025 · @0xfirefist · Mento V3 · Cantina
- [Keeping a bad price out of storage: expired reports and permissionless cleanup](https://0xsimao.com/the-contest-academy/mentorship-series-9) — Mentorship Series #9 · 17 December 2025 · @0xfirefist · Mento V3 · Cantina
- [Absurd Chainlink prices, weekend FX hours, and the breakers meant to catch both](https://0xsimao.com/the-contest-academy/mentorship-series-8) — Mentorship Series #8 · 17 December 2025 · @0xfirefist · Mento V3 · Cantina
- [Know the collateral: which price feed it needs, and manual versus automatic shutdown](https://0xsimao.com/the-contest-academy/mentorship-series-7) — Mentorship Series #7 · 17 December 2025 · @0xfirefist · Mento V3 · Cantina
- [Auditing a diff: rebuild it locally, note what you do not understand, then ask what it broke](https://0xsimao.com/the-contest-academy/mentorship-series-6) — Mentorship Series #6 · 17 December 2025 · @0xfirefist · Mento V3 · Cantina
- [Closing out Sukukfi: call-sequence bugs and self-transfers that inflate a balance](https://0xsimao.com/the-contest-academy/mentorship-series-5) — Mentorship Series #5 · 6 December 2025 · @0xfirefist · Sukukfi · Code4rena
- [Sponsor answers on the three-step vault: who eats a share price move, and why the delay exists](https://0xsimao.com/the-contest-academy/mentorship-series-4) — Mentorship Series #4 · 6 December 2025 · @0xfirefist · Sukukfi · Code4rena
- [Pricing across asynchronous vault steps, and what to re-check when a function is spammed](https://0xsimao.com/the-contest-academy/mentorship-series-3) — Mentorship Series #3 · 6 December 2025 · @0xfirefist · Sukukfi · Code4rena
- [Approaching a fresh codebase: base contracts first, then imports, inheritance and state](https://0xsimao.com/the-contest-academy/mentorship-series-2) — Mentorship Series #2 · 6 December 2025 · @0xfirefist · Sukukfi · Code4rena
- [Who 0xfirefist is, a year of full-time contests, and why they asked for mentorship](https://0xsimao.com/the-contest-academy/mentorship-series-1) — Mentorship Series #1 · 2 December 2025 · @0xfirefist

## Bug Deep Dives

33 posts.

- [LP pool cap may be exceeded on drawing settlement](https://0xsimao.com/the-contest-academy/bug-deep-dive-33) — Bug Deep Dive #33 · 18 January 2026 · Megapot · Code4rena · Cap exceeded · $9542 · 2 dups · by montecristo
- [Factory deploy reverts instead of returning address when account already exists](https://0xsimao.com/the-contest-academy/bug-deep-dive-32) — Bug Deep Dive #32 · 4 January 2026 · Sequence · Code4rena · ERC4337 · $5882 · Unique · by pfapostol
- [Static signatures bound to caller revert under ERC-4337, causing DoS](https://0xsimao.com/the-contest-academy/bug-deep-dive-31) — Bug Deep Dive #31 · 3 January 2026 · Sequence · Code4rena · ERC4337 · $1416 · 3 Dups · by Agontuk
- [Partial signature replay/frontrunning attack on session calls](https://0xsimao.com/the-contest-academy/bug-deep-dive-30) — Bug Deep Dive #30 · 27 December 2025 · Sequence · Code4rena · Sig Replay · $19609 · Unique · by montecristo
- [Chained signature with checkpoint usage disabled can bypass all checkpointer validation](https://0xsimao.com/the-contest-academy/bug-deep-dive-29) — Bug Deep Dive #29 · 25 December 2025 · Sequence · Code4rena · Sig Replay · $19609 · Unique · by hgrano
- [The collateral that liquidators receive is valued below their initial expectations as a result of the price fall](https://0xsimao.com/the-contest-academy/bug-deep-dive-28) — Bug Deep Dive #28 · 24 December 2025 · FAssets · Code4rena · Wrong Tracking · $33790 · Unique · by pashap9990
- [Accumulated rewards in FSTO can be stolen by the agent's owner](https://0xsimao.com/the-contest-academy/bug-deep-dive-27) — Bug Deep Dive #27 · 23 December 2025 · FAssets · Code4rena · Wrong Tracking · $33790 · Unique · by pashap9990
- [Vault owner is incentivized to not switch invalid collateral token during liquidation](https://0xsimao.com/the-contest-academy/bug-deep-dive-26) — Bug Deep Dive #26 · 22 December 2025 · FAssets · Code4rena · Business Logic · $33790 · Unique · by rvierdiiev
- [Gas consumed in notifyUnsubscribe is underestimated during tests and is greater than 300,000 without pre-warming](https://0xsimao.com/the-contest-academy/bug-deep-dive-25) — Bug Deep Dive #25 · 21 December 2025 · BMX · Sherlock · Out of Gas · $2613 · Unique · by cergyk
- [ViewFacet.queryAssetBalances doesn't include uncollected uniswap fees for compounded maker position](https://0xsimao.com/the-contest-academy/bug-deep-dive-24) — Bug Deep Dive #24 · 20 December 2025 · Ammplify · Sherlock · Missing Logic · $886 · Unique · by panprog
- [View::queryAssetBalances does not account for JIT penalties](https://0xsimao.com/the-contest-academy/bug-deep-dive-23) — Bug Deep Dive #23 · 19 December 2025 · Ammplify · Sherlock · Missing Logic · $886 · Unique · by tedox
- [The protocol doesnt support weird tokens like Tether Gold (that return false on every operation)](https://0xsimao.com/the-contest-academy/bug-deep-dive-22) — Bug Deep Dive #22 · 18 December 2025 · Ammplify · Sherlock · Weird Token · $886 · Unique · by anonymousjoe
- [Liquidity borrowed from or repaid to parent nodes is not always minted or burned in the uniswap pool](https://0xsimao.com/the-contest-academy/bug-deep-dive-21) — Bug Deep Dive #21 · 17 December 2025 · Ammplify · Sherlock · Accounting · $1196 · 3 dups · by panprog
- [User can lose all funds when creating or increasing compounded Maker position due to share inflation](https://0xsimao.com/the-contest-academy/bug-deep-dive-20) — Bug Deep Dive #20 · 16 December 2025 · Ammplify · Sherlock · Inflation Attack · $1196 · 3 dups · by panprog
- [Borrow fee uses APY as per-second rate, causing extreme overcharging](https://0xsimao.com/the-contest-academy/bug-deep-dive-19) — Bug Deep Dive #19 · 15 December 2025 · Ammplify · Sherlock · APY logic · $1196 · 3 dups · by blockace
- [Takers pay significantly higher fees than expected due to borrow amounts being split across segments](https://0xsimao.com/the-contest-academy/bug-deep-dive-18) — Bug Deep Dive #18 · 14 December 2025 · Ammplify · Sherlock · Fee Logic · $4432 · Unique · by panprog
- [Incorrect inside fees calculation for uninitialized uniswap ticks causes positions funds being stuck in the contract](https://0xsimao.com/the-contest-academy/bug-deep-dive-17) — Bug Deep Dive #17 · 13 December 2025 · Ammplify · Sherlock · Uniswap Fee Logic · $4432 · Unique · by panprog
- [All taker collateral and collected fees can be stolen by re-entering via RFTLib.settle to manipulate uniswap spot price](https://0xsimao.com/the-contest-academy/bug-deep-dive-16) — Bug Deep Dive #16 · 12 December 2025 · Ammplify · Sherlock · Spot Price Manipulation · $4432 · Unique · by panprog
- [Ineffective minimum order size check for ASK limit orders can lead to Denial of Service](https://0xsimao.com/the-contest-academy/bug-deep-dive-15) — Bug Deep Dive #15 · 11 December 2025 · Dango Dex · Sherlock · DoS · $1493 · 2 dups · by berndartmueller
- [XYK reflect_curve is incorrect and decreases K over time leading to loss of funds for LP providers](https://0xsimao.com/the-contest-academy/bug-deep-dive-14) — Bug Deep Dive #14 · 10 December 2025 · Dango Dex · Sherlock · Incorrect Math · $1493 · 2 dups · by haxagon
- [Price cannot be represented when a high-value base asset is quoted in a high-decimal asset](https://0xsimao.com/the-contest-academy/bug-deep-dive-13) — Bug Deep Dive #13 · 9 December 2025 · Dango Dex · Sherlock · Math Overflow · $3318 · Unique · by 0xShoonya
- [User can pause all auctions by overflow in mid-price average](https://0xsimao.com/the-contest-academy/bug-deep-dive-12) — Bug Deep Dive #12 · 8 December 2025 · Dango Dex · Sherlock · Math Overflow · $3318 · Unique · by Ziusz
- [XYK reflect_curve omits swap fee in order sizing, leaking LP fees](https://0xsimao.com/the-contest-academy/bug-deep-dive-11) — Bug Deep Dive #11 · 6 December 2025 · Dango Dex · Sherlock · Business Logic · $1493 · 2 dups · by blockace
- [Asymmetric liquidity provision to geometric pool can allow attacker to purchase at flat oracle price, irrespective of trade size](https://0xsimao.com/the-contest-academy/bug-deep-dive-10) — Bug Deep Dive #10 · 6 December 2025 · Dango Dex · Sherlock · Business Logic · $4480 · 3 dups · by haxagon
- [Users can swap at the best price by splitting swap into several small swap](https://0xsimao.com/the-contest-academy/bug-deep-dive-9) — Bug Deep Dive #9 · 5 December 2025 · Dango Dex · Sherlock · Business Logic · $1633 · 6 dups · by ami
- [Incorrect rounding direction in geometric pool ask_exact_amount_out allows theft of funds](https://0xsimao.com/the-contest-academy/bug-deep-dive-8) — Bug Deep Dive #8 · 4 December 2025 · Dango Dex · Sherlock · Incorrect Rounding · $7467 · 2 dups · by haxagon
- [Attackers will steal rewards from legitimate pools by making duplicate pools for listed token](https://0xsimao.com/the-contest-academy/bug-deep-dive-7) — Bug Deep Dive #7 · 3 December 2025 · Super DCA Liquidity Network · Sherlock · Incorrect Uniswap V4 understanding · 232 OP · 24 dups · by Kirkeelee
- [Unfair distribution of rewards for LPs](https://0xsimao.com/the-contest-academy/bug-deep-dive-6) — Bug Deep Dive #6 · 2 December 2025 · Super DCA Liquidity Network · Sherlock · Incorrect rewards distribution · 5661 OP · 2 dups · by vinica_boy
- [Foundation recall will inflate governance power for earnest voters](https://0xsimao.com/the-contest-academy/bug-deep-dive-5) — Bug Deep Dive #5 · 1 December 2025 · Summer.fi · Sherlock · Wrong variable tracking · $381 · 14 dups · by Elroi
- [Satellite chains can't execute onlyGovernance functions](https://0xsimao.com/the-contest-academy/bug-deep-dive-4) — Bug Deep Dive #4 · 30 November 2025 · Summer.fi · Sherlock · Wrong Call Path · $5668 · 3 dups · by EgisSecurity
- [Lack of Emergency Market Invalidation Mechanism](https://0xsimao.com/the-contest-academy/bug-deep-dive-3) — Bug Deep Dive #3 · 29 November 2025 · Index Fun Order Book · Sherlock · Wrong Business Logic · $720 · 5 dups · by 0xeix
- [PositionTokens violates one of the MUST rules defined in EIP-1155](https://0xsimao.com/the-contest-academy/bug-deep-dive-2) — Bug Deep Dive #2 · 28 November 2025 · Index Fun Order Book · Sherlock · EIP-1155 compliance · $720 · 5 dups · by typicalHuman
- [Asymmetric fee structure allows market participants to get the same outcome for less fee](https://0xsimao.com/the-contest-academy/bug-deep-dive-1) — Bug Deep Dive #1 · 27 November 2025 · Index Fun Order Book · Sherlock · Swap fees · $5492 · Unique · by PUSH0