header image

Shanmuga Bharathi

Shanmuga Bharathi

Security Researcher šŸ§‘ā€šŸ”¬ Vulnerability and security research disclosure reports Web3 security and cybersec kinds of stuff here šŸ§‘ā€šŸ’»šŸ”¬
Subscribe to Shanmuga Bharathi
Receive the latest updates directly to your inbox.
Card Header

RingDAO | Sending an arbitrary message without authorization of Dapps. Part-II

RingDAO is a decentralized community focused on the latest innovations in the cross-chain field within the web3 world. Our mission is to empower existing and future applications to interact seamlessly with multiple blockchain networks.
Card Header

Darwinia | Sending an arbitrary message without authorization of user application. Part-I

Darwinia is currently at the forefront of developing innovative cross-chain service solutions, with a strategic focus on enhancing the cross-chain capabilities of decentralized applications.
Card Header

Open Source Security Research | How I Found Dependency Confusion vuln on Web2 and Web3 firms.

Dependency confusion, sometimes referred to as substitution attack, dependency repository hijacking, or simply repo jacking, is a software supply chain assault in which a valid internal software dependency is replaced with malicious third-party code.
Card Header

Security research disclosure | Optimism Bridge Portal

The OptimismPortal contract is an L1 smart contract that can be used by both smart contracts and EOAs to create L2 transactions without the direct involvement of the Sequencer. Many users already interact with this contract indirectly when they bridge ETH or other tokens between L1 and L2 via the Standard Bridge system available on all OP Stack chains.
Card Header

Solidity lang Compiler | Bringing back Arithmetic bug over ^0.8.0 version.

This write-up will explain my accidental discovery of a solidity compiler bug. During a security audit on a protocol, I came across an interesting and Known compiler bug on solidity. I quickly escalated to the Ethereum security team and got a well-expected response.
Card Header

OASYS | Stealing of User's NFT From L1 Contract

The Oasys ecosystem consists of two major parts by structure: the Hub Layer and the Verse Layer. The Hub Layer is responsible for the data availability, security, and stability of the entire ecosystem, with the backing of trustworthy validators. The Verse Layer is the contents layer, and it's the home for all the games. The primary concern of every verse layer is gamers and game developers.
Card Header

Buttonwood Security Report

Buttonwood is a collection of DeFi primitives for building powerful decentralized financial instruments. One of Buttonwood's insights is that everything in finance is some form of a tranche. The ButtonTranche contracts serve as a foundation for marketplaces such as liquidation-free debt, convertible bonds, and options, and assets like fiat-free stablecoins.
Card Header

MakerDAO Security Report

MakerDAO is a decentralized organization dedicated to bringing stability to the cryptocurrency economy. The Maker Protocol employs a two-token system. The first being, Dai, a collateral-backed stablecoin that offers stability. The Maker Foundation and the MakerDAO community believe that a decentralized stablecoin is required to have any business or individual realize the advantages of digital money. Second, there is MKR, a governance token that is used by stakeholders to maintain the system and manage Dai. MKR token holders are the decision-makers of the Maker Protocol, supported by the larger public community and various other external parties.
Card Header

Incorrect Function visibility leads to the Stealing of Betverse ICO Tokens.

A critical vulnerability was discovered in one of the Testnet projects on the Immunefi Platform, the Betverse ICO Token contract’s transferTokenToLockedAddresses() function. The vulnerability was caused by mistakenly marking this function as public when it should have been an internal function. This mistake enabled anyone to transfer a specified amount of BToken (amount.div(term)) to the attacker's time lock address. Repeating this attack could lead to the sweeping of the BToken balance of the ICOToken contract.