Skip Navigation
Code4rena Logo
  • Roles
    • Wardens

      Auditing code, identifying bugs, and getting paid.

    • Projects

      Creating a safer web3 ecosystem by securing their code.

    • Judges

      Experts shaping the web3 security industry for the better.

    • Scouts

      Streamlining security through scoping.

    • Lookouts

      Making web3 audits as efficient as possible.

    • Team Captains

      Where leadership talent meets opportunity.

    Security Solutions
    • Pro League

      New!

    • Open Audit
    • Private Audit
    • Invitational Audit
    • Mitigation Review
    • Test Coverage
    • Bot Races
    • Blue Team Retainers
    • Bug Bounties
    Connect
    • Twitter
    • Discord
    • YouTube
    • GitHub

  • Ready to secure your project?

    The best time to start is now.

    Get started
    Security Solutions
    • Pro League

      New!

      The elite tier of professional security researchers, assembled for your project.

    • Open Audit

      Explore Code4rena's standard competitive audit format.

    • Invitational Audit

      Assess freshly audited code with top-perfoming Wardens.

    • Test Coverage

      Collaborate with elite Wardens.

    • Private Audit

      Customize an audit to meet your security needs.

    • Mitigation Review

      Embed security into your development lifecycle.

    • Bot Races

      Automatically detect low-hanging fruit and reduce time spent on known issues.

    • Blue Team Retainers

      Dedicated defense. Competitive bug bounties. Independent judging.

    Resources
    • Docs
    • Reports
    • Blog

  • Find bugs. Get paid.

    Put your security research skills to work.

    Become a Warden
    Audits
    • Ongoing Audits
    • Upcoming Audits
    • Past Audits
    • Bounties
    Leaderboard
    • Past 90 days
    • Past 365 days
    • All time
    Resources
    • Are you a Pro?

      New!

    • Reports
    • Blog
    • Newsletter
    • Help Desk
    • Docs
    • GitHub
  • Support
  • Log in

    • Login

    login iconLog in / Register
    Get an audit
Code4rena Logo
  • An open organization
  • Twitter
  • Discord
  • GitHub
  • Blog
  • Newsletter
  • Media kit
  • Careers
  • code4rena.eth
samczsun Profile

samczsun

Expert profile

OG Warden

Sushi

$350M USDC Protected

Gelato

$27M USDC Protected

Highlights

  • SushiSwap

    1M USDC bounty for assistance in discovering and mitigating a Miso vulnerability

    "Sam helped mitigate $350M in potential financial losses and we are very grateful and even happy to pay this bounty."

  • Fuse

    Tracked down the source of the $80M Fuse hack

    "Fuse added a faily sophisticated system for global reentrancy protection on top of the forked Compound contracts, but the exitMarket() method was missing a reentrancy check. (Credit to @samczsun for tracking it down)"

  • Geth

    Identified multiple vulnerabilities in go-ethereum

    "What if you could hard fork the Ethereum blockchain with a snap of your fingers?"

Security research posts

Open source contributions

  • OpenChain

    A collection of open source tools. Look up unknown function selectors or event topics, a transaction tracer, and tools for encoding/decoding ABI data

    • GitHub
    • openchain.xyz

In the press

About

Whitehat security researcher

Member of Paradigm

  • Twitter
  • samczsun.com
  • GitHub
Hiding in Plain Sight

samczsun.com

Hiding in Plain Sight

Most people trust, but how many people verify?

Two Rights Might Make A Wrong

samczsun.com

Two Rights Might Make A Wrong

Too much raw fish doesn't make a better roll of sushi.

The Dangers of Surprising Code

samczsun.com

The Dangers of Surprising Code

The only thing worse than a bug in your code that breaks everything is a bug in your code that subtly breaks one thing.

The 'U Up?' Files with samczsun

medium.com

The 'U Up?' Files with samczsun

Few names strike more fear into the hearts of blackhats than samczsun, known as perhaps the most prolific whitehat in DeFi security.

Attacker hijacks Tornado Cash governance via malicious proposal

cointelegraph.com

Attacker hijacks Tornado Cash governance via malicious proposal

The total control over Tornado Cash governance allows the attacker to withdraw all of the locked votes, drain all of the tokens in the governance contract and brick the router.

Tokenlon 4.0 fee incident disclosure

tokenlon.medium.com

Tokenlon 4.0 fee incident disclosure
Fixed: potential vulnerability in contract used during private beta

medium.com

Fixed: potential vulnerability in contract used during private beta
Sorbet Finance Vulnerability Post Mortem

medium.com

Sorbet Finance Vulnerability Post Mortem

How the Gelato team and honorable community members rescued $27M at risk from an attacker.