Log in
chonilius
26200
All-time points
View user on GitHub
Share
Linked accounts
No accounts linked
Org Memberships
1
MergeFi
Resolved Issues
123
Closed
200 Points
#97
Deployment scripts do not verify deployed contract IDs against API environment configuration
verdant-bond-protocol/verdant-bond-protocol
Closed
200 Points
#96
Credit retirement flow lacks API and frontend integration despite having a Soroban contract
verdant-bond-protocol/verdant-bond-protocol
Closed
200 Points
#94
Oracle provider registration has no API-side uniqueness, methodology compatibility, or lifecycle validation
verdant-bond-protocol/verdant-bond-protocol
Closed
200 Points
#92
Quote asset handling is not normalized across API DTOs, contract symbols, and frontend display
verdant-bond-protocol/verdant-bond-protocol
Closed
200 Points
#708
Add randomized tie-breaking to the funding queue per threat model's open recommendation
Invoice-Liquidity-Network/ILN-Smart-Contract
Closed
200 Points
#707
Add front-running resistance analysis for `fund_invoice` outside the MEV queue path
Invoice-Liquidity-Network/ILN-Smart-Contract
Closed
200 Points
#704
Add integration test for governance-executed parameter change propagating correctly to `reputation_bonus`
Invoice-Liquidity-Network/ILN-Smart-Contract
Closed
200 Points
#703
Add a contract dependency graph diagram to architecture docs
Invoice-Liquidity-Network/ILN-Smart-Contract
Closed
200 Points
#447
[Bug] Pools page crashes with TypeError when pool.apy is null or undefined
Parashield-Protocol/parashield-frontend
Closed
200 Points
#446
[Bug] useKeyboardShortcut hook re-runs effect on every render due to mutable default modifiers
Parashield-Protocol/parashield-frontend
Closed
200 Points
#438
[UX] Claims page auto-refresh interval not configurable and no visual countdown
Parashield-Protocol/parashield-frontend
Closed
200 Points
#437
[Consistency] Dark mode classes use both dark: prefix and className-based approach inconsistently
Parashield-Protocol/parashield-frontend
Closed
200 Points
#322
web3: Implement event listening for contract events
AudioBitsStellar/AudioBlocks_Frontend_v1
Closed
200 Points
#321
web3: Add block explorer links
AudioBitsStellar/AudioBlocks_Frontend_v1
Closed
200 Points
#318
web3: Implement gas estimation
AudioBitsStellar/AudioBlocks_Frontend_v1
Closed
200 Points
#317
web3: Add ENS name resolution
AudioBitsStellar/AudioBlocks_Frontend_v1
Closed
200 Points
#1169
Add cross-network token mapping validation for unsupported assets
edehvictor/StellarYield
Closed
200 Points
#1168
Add bridge transfer status reconciliation for delayed confirmations
edehvictor/StellarYield
Closed
200 Points
#1161
Add treasury reserve runway calculation tests
edehvictor/StellarYield
Closed
200 Points
#1160
Add reward campaign budget exhaustion warnings
edehvictor/StellarYield
Closed
200 Points
#431
investment_vault: is_funding_round_active() getter has zero direct test coverage
Heliobond/contracts
Closed
200 Points
#430
investment_vault: get_deposit_lock_expiry() has zero test coverage
Heliobond/contracts
Closed
200 Points
#429
investment_vault: set_carbon_oracle() and set_max_transaction_amount() are never called successfully in any test — only their admin-rejection path is covered
Heliobond/contracts
Closed
200 Points
#428
investment_vault: set_bridge() and set_wormhole_core() are never called successfully in any test — only their admin-rejection path is covered
Heliobond/contracts
Closed
200 Points
#1252
RFC: Formally separate process-env configuration from DB-backed runtime configuration
privexlabs/BrandBlitz
Closed
200 Points
#1251
RFC: Replace the admin config discriminated-union with per-key schema modules
privexlabs/BrandBlitz
Closed
200 Points
#1248
RFC: Extract a shared BullMQ queue/worker factory instead of seven hand-rolled setups
privexlabs/BrandBlitz
Closed
200 Points
#1246
Document how users can view current and historical legal document versions
privexlabs/BrandBlitz
Closed
200 Points
#635
exchange_router::update_withdrawal_handler accepts any address with no sanity checks against misconfiguration
SO4-Markets/contracts
Closed
200 Points
#634
order_handler::set_keeper_heartbeat_timeout accepts 0, making any active keeper appear permanently stale
SO4-Markets/contracts
Closed
200 Points
#633
data_store::set_liquidation_execution_fee has no upper bound — a misconfigured value can seize a liquidated position's entire collateral as keeper fee
SO4-Markets/contracts
Closed
200 Points
#632
market_token::initialize never calls admin.require_auth(), unlike every other contract's initialize; the stored admin field is also otherwise unused
SO4-Markets/contracts
Closed
200 Points
#286
Docs: README function signatures for cancel/pause/resume/top_up omit the required caller parameter
conduit-protocol/streamFi-contracts
Closed
200 Points
#285
Bug: WalletConnection.tsx has no timeout guard around its mutation, unlike StreamCreation.tsx's fix for the same class of bug
conduit-protocol/streamFi-contracts
Closed
200 Points
#284
Bug: Notifications.tsx validates a hardcoded literal that can never fail validation
conduit-protocol/streamFi-contracts
Closed
200 Points
#283
Docs: CHANGELOG credits the token-selector cache fix (#153) to the wrong component
conduit-protocol/streamFi-contracts
Closed
200 Points
#127
PoolDetailClient's deposit modal has no amount format validation — invalid input reaches amountToStroops deep in the sign flow instead of being caught at the input
SmartDropLabs/smartdrop-frontend
Closed
200 Points
#126
Non-production QueryClient exposed on window.__queryClient leaks the Alerts page's raw backend API key via cached React Query keys
SmartDropLabs/smartdrop-frontend
Closed
200 Points
#125
No test coverage exists for the /api/sign-fee-bump route — the only server-side code holding the fee-sponsor secret key is completely unverified
SmartDropLabs/smartdrop-frontend
Closed
200 Points
#124
api/sign-fee-bump: fee-bump sponsorship signs any transaction XDR with no validation, auth, or rate limit — unbounded sponsor-drain vector
SmartDropLabs/smartdrop-frontend
Closed
200 Points
#178
[Race condition] TOCTOU in `submitClaim`'s own duplicate-claim guard
Parashield-Protocol/parashield-backend
Closed
200 Points
#177
[Security] `submitClaim` never verifies the caller owns the policy being claimed against
Parashield-Protocol/parashield-backend
Closed
200 Points
#176
[Security] `confirmPolicy` endpoint doesn't verify `dto.walletAddress` matches the authenticated JWT wallet
Parashield-Protocol/parashield-backend
Closed
200 Points
#175
[Bug] Policy `duration` is never validated against the product's `maxDuration`
Parashield-Protocol/parashield-backend
Closed
200 Points
#1210
Z014: Detect missing merkle-root inclusion-proof verification
HyperSafeD/Sanctifier
Closed
200 Points
#1209
Z013: Detect insufficient batch-validation in ZK-rollup style state transitions
HyperSafeD/Sanctifier
Closed
200 Points
#1208
Z012: Detect zero-knowledge property leak via public-output over-exposure
HyperSafeD/Sanctifier
Closed
200 Points
#1204
Z008: Detect curve/field mismatch between on-chain verifier and off-chain circuit
HyperSafeD/Sanctifier
Closed
200 Points
#618
feat(wallet): add transaction receipt/export as PDF for individual ECHO transfers
Echo-Mirror-Butler/Echo-Mirror-Butler-
Closed
200 Points
#607
feat(flutter): add state restoration support so the OS can restore navigation/form state after the app is killed
Echo-Mirror-Butler/Echo-Mirror-Butler-