audits - GitLite

KO | EN

gitlite — search

#python #react #go #android #machine-learning #rust #deep-learning #macos #windows #awesome #cli #awesome-list #mcp #open-source

audits

(★ 76)

Bugs founds and Audit reports Done by me (Al-Qa'qa')

File Explorer

Download Latest Version (.zip)

- 2023-10-nextgen.md
- 2023-10-opendollar.md
- 2023-11-zetachain.md
- 2024-01-covalent.md
- 2024-02-unistaker.md
- 2024-03-poolTogether.md
- 2024-03-radicalxChange.md
- 2024-04-dyad.md
- 2024-05-optimism-safe.md
- 2024-06-Intuition.md
- 2024-07-atkBridge.md
- 2024-08-zetachain.md
- 2024-10-swan.md
- 2024-12-soon.md
- 2025-03-18-cyfrin-Metamask-DelegationFramework1-v2.0.pdf
- 2025-05-23-cyfrin-securitize-solana-vault-v2.0.pdf
- 2026-02-04-cyfrin-stakedotlink-espresso-v2.0.pdf
- 2026-05-12-cyfrin-molecule-onchainlab-v2.0.pdf
- 2026-06-02-cyfrin-securitize-svm-whitelist-acl-support-v2.0.pdf
- Etherspot-CAM-Migration-Security-Review.pdf
- Etherspot-CAM-Security-Review.pdf
- README.md
- Dyad-LpStaking-security-review.pdf
- Dyad-TimeLock-security-review.pdf
- DYAD-VaultManagerV3-security-review.pdf
- Dyad-VaultManagerV5-security-review.pdf
- DYAD-weETH-security-review.pdf
- DyadXP-security-review.pdf
- DyadXPv2-security-review.pdf
- khuga-Labs-security-review.pdf
- Merit-System-Security-review-round3.pdf
- Merit-System-Security-review-x402-fund-contract.pdf
- Merit-Systems-ledger-security-review-round-2.pdf
- Merit-Systems-ledger-security-review.pdf
- README.md
- TakaDAO-referralGateway-security-review.pdf
- Venice-security-review.pdf
ask-for-audit.md
README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Al-Qa'qa' Auditing Portfolio
My audit portfolio contains the contests I participated in and my engagements in Web3 security.

For private audits, check this [link](/ask-for-audit.md).

## About Al-Qa'qa'
I am an Independent Web3 security researcher, focusing on Dapps, and DeFi.

I am doing contests on different platforms like [Sherlock](https://audits.sherlock.xyz/watson/al-qa-qa), and [Cantina](https://cantina.xyz/u/al-qa-qa).

- Twitter: [@Al_Qa_qa](https://twitter.com/Al_Qa_qa)
- Discord: [@Al_Qa_qa](https://discord.com/channels/al_qa_qa)
- Telegram: [@Al_Qa_qa](https://t.me/al_qa_qa)

## Private Audits

|Protocol|Scope|Description|Findings|Report|
|:-------|:----|:----------|:-------|:----:|
|[Merit Systems](https://x.com/merit_systems)|x402-fund-contract|x402, Funding, Escrow|1 M| [📄](Solo/Merit-System-Security-review-x402-fund-contract.pdf) |
|[Merit Systems](https://x.com/merit_systems)|[Escrow](https://github.com/Merit-Systems/contracts/tree/86786d6c6728fad690be7e2c7a76640f6ad7d0b8)|Escrow|3 L| [📄](Solo/Merit-System-Security-review-round3.pdf) |
|[Khuga Labs](https://github.com/KhugaLabs)|[khugabash-smartcontract](https://github.com/KhugaLabs/khugabash-smartcontract/tree/afb2c4a8d2cec20c79d477ec3fdc004707f69478)|Gaming, NFTs|2 H, 2 M, 5 L|[📄](Solo/khuga-Labs-security-review.pdf)|
|[Merit Systems](https://x.com/merit_systems)|[Escrow](https://github.com/Merit-Systems/contracts/tree/907bff682a5cdd36e4e43386fe99c33aae516048)|Escrow|None| [📄](Solo/Merit-Systems-ledger-security-review-round-2.pdf) |
|[Merit Systems](https://x.com/merit_systems)|[SplitWithLockup](https://github.com/Merit-Systems/contracts/tree/87407971342432c1cf52cf378bdfa8355f612807)|Escrow|2 M, 1L| [📄](Solo/Merit-Systems-ledger-security-review.pdf) |
|[Venice](https://x.com/askvenice)|Private|ERC20, Staking|3 H, 2 M|[📄](Solo/Venice-security-review.pdf)|
|[DYAD](https://www.dyadstable.xyz/)|[TimeLock](https://github.com/DyadStablecoin/contracts/tree/84f8337d024ebf289e102f352fdb14b5fccc9418)|TimeLock, Staking Rewards|2 M|[📄](Solo/Dyad-TimeLock-security-review.pdf)|
|[TakaDAO](https://takadao.io/)|[ReferralGateway](https://github.com/TakafulDAO/takasure.sc/tree/986e61d7e25209e675bf86dbf2edbf871c052247)|DAOs, Referral System|3 H, 4 M, 4 L|[📄](Solo/TakaDAO-referralGateway-security-review.pdf)|
|[DYAD](https://www.dyadstable.xyz/)|[LpStaking](https://github.com/DyadStablecoin/contracts/tree/b76cf79afdb2c68bc4f432597c593ab9a29a65b4)|Staking, Transit Storage|2 H, 1 M, 3 L|[📄](Solo/Dyad-LpStaking-security-review.pdf)|
|[DYAD](https://www.dyadstable.xyz/)|[DyadXPv2](https://github.com/DyadStablecoin/contracts/tree/973cb961198890449e0a80b4be4065dccff0abc0)|Staking, UniswapV3 integration|1 H, 1 M, 2 L| [📄](Solo/DyadXPv2-security-review.pdf)|
|[DYAD](https://www.dyadstable.xyz/)|[VaultManagerV5](https://github.com/DyadStablecoin/contracts/tree/7a7229a83f6e8ffddf2a303a41aa80c70fe44642)|Stablecoin, Hooks|1 H, 1 M, 2 L| [📄](Solo/Dyad-VaultManagerV5-security-review.pdf)|
|[DYAD](https://www.dyadstable.xyz/)|[weETH Vault](https://github.com/DyadStablecoin/contracts/tree/c230ef5b2cb6c3b6e60081f32d78b034a7a410cb)|Vault, weETH token|1 M|[📄](Solo/DYAD-weETH-security-review.pdf)|
|[DYAD](https://www.dyadstable.xyz/)|[DyadXP](https://github.com/DyadStablecoin/contracts/tree/a8245ea3671dfada7bd3845f2862f384a9294066)|Staking, Time-Weighted token|2 H, 3 M, 3 L|[📄](Solo/DyadXP-security-review.pdf)|
|[DYAD](https://www.dyadstable.xyz/)|[VaultManagerV3](https://github.com/DyadStablecoin/contracts/tree/3ddcbcc7616ba6cacef4f381c90bda6b8f2245d4)|Stablecoin|2 H, 3 M, 2 L|[📄](Solo/DYAD-VaultManagerV3-security-review.pdf)|

## Engagments
|Company|Protocol|Description|Findings|Report|
|:------|:-------|:----------|:-------|:----:|
|[Cyfrin](https://www.cyfrin.io/)|[MetaMask](https://metamask.io/)|Account Abstraction, Delegations Modules|1 H, 2 M, 5 L|[📄](engagments/2025-03-18-cyfrin-Metamask-DelegationFramework1-v2.0.pdf)|
|Undisclosure|Undisclosure|SVM, Tokenization, time-weight staking|Private| -- |
|[Cyfrin](https://www.cyfrin.io/)|[Securitize](https://x.com/Securitize)|SVM, Staking, RWA|1 H, 1 M, 5 L| [📄](engagments/2025-05-23-cyfrin-securitize-solana-vault-v2.0.pdf) |
|[Sheildify](https://www.shieldify.org/)|[Etherspot](https://x.com/etherspot)|Account Abstraction, ERC-7579|12 C/H, 2 M, 8 L| [📄](engagments/Etherspot-CAM-Security-Review.pdf) |
|[Sheildify](https://www.shieldify.org/)|[Etherspot](https://x.com/etherspot)|Account Abstraction, ERC-7579|2 C/H, 2 M, 4 L| [📄](engagments/Etherspot-CAM-Migration-Security-Review.pdf) |
|[Cyfrin](https://www.cyfrin.io/)|Undisclosure|Staking, RWA|Private| -- |
|Undisclosure|Undisclosure|SVM, staking|Private| -- |
|[Bailsec](https://x.com/bailsecurity)|HyperLedger|Staking, delegations, Vaults| Private | -- |
|Undisclosure|Undisclosure|SUI/Move, CLAMM, staking|Private| -- |
|[Cyfrin](https://www.cyfrin.io/)|Undisclosure|Tron, Escrow, Cross chain|Private| -- |
|[Cyfrin](https://www.cyfrin.io/)|Undisclosure|SVM, Escrow, Cross chain|Private| -- |
|[Sheildify](https://www.shieldify.org/)|[Etherspot](https://x.com/etherspot)|Account Abstraction, Escrow|4 C/H, 6 M, 8 L| [📄](engagments/Etherspot-CAM-Migration-Security-Review.pdf) |
|[Cyfrin](https://www.cyfrin.io/)|Undisclosure|Cross Chain, Bridge|Private| -- |
|[Cyfrin](https://www.cyfrin.io/)|Undisclosure|L2, ZK rollups|Private| -- |
|[Cyfrin](https://www.cyfrin.io/)|Undisclosure|Cross Chain, Bridge|Private| -- |
|[Cyfrin](https://www.cyfrin.io/)|[Stake.Link](https://x.com/stakedotlink)|Staking, Vaults Strategies|2 M, 5 L| [📄](engagments/2026-02-04-cyfrin-stakedotlink-espresso-v2.0.pdf) |
|[Cyfrin](https://www.cyfrin.io/)|Undisclosure|Cross chain, Invoice Management|Private| -- |
|[Cyfrin](https://www.cyfrin.io/)|Undisclosure|Account Abstraction, EIP7702|Private| -- |
|[Cyfrin](https://www.cyfrin.io/)|Undisclosure|Account Abstraction, SVM|Private| -- |
|[Cyfrin](https://www.cyfrin.io/)|[Molecule](https://x.com/Molecule_sci)|Account Abstraction, Token Bound Accounts|3 C/H, 4 M, 11 L| [📄](engagments/2026-05-12-cyfrin-molecule-onchainlab-v2.0.pdf) |
|[Cyfrin](https://www.cyfrin.io/)|[Securitize](https://x.com/Securitize)|SVM, Token Whitelisting|1 L| [📄](engagments/2026-06-02-cyfrin-securitize-svm-whitelist-acl-support-v2.0.pdf) |
|[Cyfrin](https://www.cyfrin.io/)|Undisclosure|Token Revocation, Permit2 |Private| -- |

## Highlights
|Contest|Description|Findings|Rank|Report|
|:------|:----------|:-------|:--:|:----:|
|[Soon](https://cantina.xyz/competitions/08c2b0b4-8449-4136-82a2-7074ccdfffac/leaderboard)|SVM, layer2, OP Stack|[4 H, 10 M, 3 L](Contests/2024-12-soon.md)|🥇| - |
|[Ark Bridge](https://codehawks.cyfrin.io/c/2024-07-ark-project/results?lt=contest&sc=reward&sj=reward&page=1&t=leaderboard)|NFT Bridge, Starknet|[5 H, 3 M, 5 L](Contests/2024-07-atkBridge.md)|🥇| [📄](https://codehawks.cyfrin.io/c/2024-07-ark-project/results?lt=contest&sc=reward&sj=reward&page=1&t=report)|
|[Intuition](https://app.hats.finance/audit-competitions/intuition-0x538dbadc50cc87b281cd655f1edbc6ebda02a66a/leaderboard)|Account Abstraction, Vaults|[2 L](Contests/2024-06-Intuition.md)|🥇| [📄](https://app.hats.finance/audit-competitions/intuition-0x538dbadc50cc87b281cd655f1edbc6ebda02a66a/submissions)|
|[UniStaker](https://code4rena.com/audits/2024-02-unistaker-infrastructure#top)|Staking, Voting|[5 L](Contests/2024-02-unistaker.md)|🥈| [📄](https://code4rena.com/reports/2024-02-uniswap-foundation)|
|[RadicalxChange](https://audits.sherlock.xyz/contests/191)|NFTs, Auction, Diamond Proxy|[1 H, 1 M](Contests/2024-03-radicalxChange.md)|🥈|[📄](https://audits.sherlock.xyz/contests/191/report)|
|[PoolTogethar](https://code4rena.com/audits/2024-03-pooltogether)|Vaults, ERC4626|[1 H, 2 M, 3 L](Contests/2024-03-poolTogether.md)|🥉️|[📄](https://code4rena.com/reports/2024-03-pooltogether)|
|[Zetachain](https://cantina.xyz/competitions/80a33cf0-ad69-4163-a269-d27756aacb5e/leaderboard)|Layer1, Cross Chain, Omnichain|[2 H, 6 M](Contests/2024-08-zetachain.md)|🥉️| - |

## Audit Contests
|Contest|Description|Findings|Rank|Report|
|:------|:----------|:-------|:--:|:----:|
|[Optimism InterOP](https://cantina.xyz/competitions/44b385bf-e51a-4e6c-b3a8-adbbe24d16e1)|Layer2, OP stack|1 L|5th| - |
|[Farcaster](https://cantina.xyz/competitions/f9326d2b-bb99-45a9-88c5-94c54aa1823a/leaderboard)|EAS, Social Network|5 H, 2 M, 9 L|6th| - |
|[Soon](https://cantina.xyz/competitions/08c2b0b4-8449-4136-82a2-7074ccdfffac/leaderboard)|SVM, layer2, OP Stack|[4 H, 10 M, 3 L](Contests/2024-12-soon.md)|🥇| - |
|[Swan Protocol](https://codehawks.cyfrin.io/c/2024-07-ark-project/results?lt=contest&sc=reward&sj=reward&page=1&t=leaderboard)|NFTs, AI, Statistics|[2 H, 3 M, 1 L](/Contests/2024-10-swan.md)|7th| [📄](https://codehawks.cyfrin.io/c/2024-10-swan-dria/results?t=report&lt=contest&sc=reward&sj=reward&page=1)|
|[Zetachain](https://cantina.xyz/competitions/80a33cf0-ad69-4163-a269-d27756aacb5e/leaderboard)|Layer1, Cross Chain, Omnichain|[2 H, 6 M](Contests/2024-08-zetachain.md)|🥉️| - |
|[Ark Bridge](https://codehawks.cyfrin.io/c/2024-07-ark-project/results?lt=contest&sc=reward&sj=reward&page=1&t=leaderboard)|NFT Bridge, Starknet|[5 H, 3 M, 5 L](Contests/2024-07-atkBridge.md)|🥇| [📄](https://codehawks.cyfrin.io/c/2024-07-ark-project/results?lt=contest&sc=reward&sj=reward&page=1&t=report)|
|[Intuition](https://app.hats.finance/audit-competitions/intuition-0x538dbadc50cc87b281cd655f1edbc6ebda02a66a/leaderboard)|Account Abstraction, Vaults|[2 L](Contests/2024-06-Intuition.md)|🥇| [📄](https://app.hats.finance/audit-competitions/intuition-0x538dbadc50cc87b281cd655f1edbc6ebda02a66a/submissions)|
|[Optimism-Safe](https://cantina.xyz/leaderboard/d47f8096-8858-437d-a9f5-2fe85ac9b95e)|MultiSig, Safe Wallet|[1 M, 1 L](Contests/2024-05-optimism-safe.md)|15th|[📄](https://cantina.xyz/portfolio/1b6a9e55-49a8-46e9-8272-a849fd60fcc4)|
|[DYAD](https://code4rena.com/audits/2024-04-dyad#top)|Stablecoin|[3 H, 3 M, 6L](Contests/2024-04-dyad.md)|4th|[📄](https://code4rena.com/reports/2024-04-dyad)|
|[RadicalxChange](https://audits.sherlock.xyz/contests/191)|NFTs, Auction, Diamond Proxy|[1 H, 1 M](Contests/2024-03-radicalxChange.md)|🥈|[📄](https://audits.sherlock.xyz/contests/191/report)|
|[PoolTogethar](https://code4rena.com/audits/2024-03-pooltogether)|Vaults, ERC4626|[1 H, 2 M, 3 L](Contests/2024-03-poolTogether.md)|🥉️|[📄](https://code4rena.com/reports/2024-03-pooltogether)|
|[UniStaker](https://code4rena.com/audits/2024-02-unistaker-infrastructure#top)|Staking, Voting|[5 L](Contests/2024-02-unistaker.md)|🥈| [📄](https://code4rena.com/reports/2024-02-uniswap-foundation)|
|[Covelant](https://audits.sherlock.xyz/contests/127)|Staking, Nodes Block Producers|[1 M](Contests/2024-01-covalent.md)|15th|[📄](https://audits.sherlock.xyz/contests/127/report)|
|[ZetaChain](https://code4rena.com/audits/2023-11-zetachain#top)|L1, OmniChain, Cross-chain|[1 H, 11 L](Contests/2023-11-zetachain.md)|11th| [📄](https://code4rena.com/reports/2023-11-zetachain) |
|[NextGen](https://code4rena.com/audits/2023-10-nextgen#top)|NFTs, Airdrops|[3 H, 1 M](Contests/2023-10-nextgen.md)|43th|[📄](https://code4rena.com/reports/2023-10-nextgen)|
|[OpenDollar](https://code4rena.com/audits/2023-10-open-dollar#top)|Stable Coin|[2 L](Contests/2023-10-opendollar.md)|75th|[📄](https://code4rena.com/reports/2023-10-opendollar)|

## OpenSource Projects

- [OpenZeppelin Ethernauts CTF Solutions using Foundry](https://github.com/Al-Qa-qa/ethernaut-solutions-foundry)
- [Web3 Security Tutorial | Bank Challenge](https://github.com/Al-Qa-qa/bank-web3-security-tutorial)