I help DeFi teams prevent insolvency, withdrawal freezes, and permission bypasses — with reproducible PoCs and fix-ready guidance.
Responsible disclosure. Professional communication. Scoped engagements.
Optional: I can implement patches and test harnesses alongside the audit.
Identify assets, roles, trust boundaries, and failure modes.
Define what must never break: solvency, withdrawability, and permission integrity.
Build minimal reproducible tests (Foundry), forks where needed, and targeted fuzzing.
Clear severity justification, PoCs, and fix-ready recommendations with verification steps.
High-signal security research, optimized for fast triage and reproducibility.
Identified a permissioning logic flaw that could expand allowed external calls beyond intended boundaries. Delivered a minimal PoC and a policy-aligned fix.
Demonstrated a failure mode where a single dependency revert could block withdrawals under realistic conditions. Provided mitigation patterns and verification steps.
No sensitive targets or exploit details are disclosed publicly.
Repo access (private is fine), scope list, deployed addresses/chains (if any), timeline, and any constraints.
By mapping impact and exploitability to program policy, including recoverability (e.g., funds frozen vs. quickly fixable).
Yes — reproducible tests or clear reproduction steps, plus verification guidance for the fix.
Yes — optional patch implementation and harness improvements, depending on timeline and scope.
For audit requests, include: scope, repos, chains, launch date, and preferred timeline.