Security research

Security

Alongside building products, I break them. I started in bug bounties in early 2025, then moved into private protocol audits — reviewing blockchains, nodes, bridges and smart contracts, and proving each issue with a working exploit before it gets written up.

9Critical findings
13High findings
54Targets reviewed
22Proven with a PoC

The work below is real and every finding shipped with a proof-of-concept that ran against production code, not a mock. The write-ups are deliberately abstract: no PoC, no product name, and nothing that points at the affected system. Many of these targets are live, so the specifics stay between me and the program that owns them.

How I work

  1. 01

    Attacker-first reading

    I read the code the way an attacker would: what does this trust, what does it assume is well-formed, and what happens the first time that assumption is false.

  2. 02

    Prove it or drop it

    Nothing counts until it runs. Every finding here has an exploit that reproduces against real dependencies. If it only worked against a mock, it didn't make the list.

  3. 03

    Rate it honestly

    Severity is the corrected rating, not an optimistic first guess. Several candidates were downgraded or thrown out once I tested them against live behaviour.

  4. 04

    Disclose responsibly

    Findings go to the program's official channel first and stay private until fixes ship. That's why this page names no targets.

Selected findings

22 write-ups

  1. CriticalWallet & client safety

    Confirmation screen states that nothing will leave the account while approving an unrestricted transfer

    Browser wallet extension

  2. CriticalConsensus & liveness

    A single malformed peer-to-peer message crashes a node before any validation runs

    Layer-1 node daemon

  3. CriticalValue integrity

    A single locked output can be spent several times inside one transaction, minting value from nothing

    Privacy chain (multi-signature consensus)

  4. CriticalConsensus & liveness

    An unvalidated field in submitted data panics every node deterministically

    Layer-1 state machine

  5. CriticalConsensus & liveness

    A missing uniqueness check on submitted certificates trips a hard failure during block processing

    Sidechain-enabled Layer-1

  6. CriticalProtocol logic

    Finality proofs are accepted without being bound to the block they claim to finalise

    Light client

  7. CriticalConsensus & liveness

    A configuration change drives issuance below zero and panics block production

    Proof-of-stake chain (issuance module)

  8. CriticalConsensus & liveness

    An unbounded incoming amount overflows a fixed-width integer and panics end-of-block processing

    Cross-chain bridge module

  9. CriticalValue integrity

    Unauthenticated execution traces are applied to real state, forging balances

    Privacy Layer-1 (non-hardware-attested path)

  10. HighProtocol logic

    A withdrawal is signed using another withdrawal's input amounts during a migration

    Pegged-asset bridge

  11. HighAccess control

    A secondary balance path skips the historical-snapshot guard used for voting power

    Vote-escrow governance token

  12. HighOracle integrity

    A cached validity flag serves expired or invalid prices as if they were current

    On-chain price oracle

  13. HighValue integrity

    A time-of-check/time-of-use race in provider accounting allows unbounded free service

    On-chain voucher marketplace

  14. HighConsensus & liveness

    Unordered collections serialize differently across nodes, splitting consensus

    Smart-contract Layer-1

  15. HighProtocol logic

    A node signs availability confirmations before verifying the data it is attesting to

    Decentralised storage node

  16. HighConsensus & liveness

    A missing size bound in a network reader lets a tiny crafted packet crash the node

    Feeless Layer-1 node

  17. HighValue integrity

    An unguarded internal swap during fee-pool refill can be sandwiched for profit

    On-chain DeFi module

  18. HighAccess control

    A privileged submission skips validation, letting one member forge the deciding record

    On-chain stablecoin

  19. HighAccess control

    A privileged role can enrol a holder without their consent and capture their yield

    Token-extension program

  20. HighProtocol logic

    A missing timestamp check lets the block source choose which rule set validates it

    Stateless validator

  21. HighConsensus & liveness

    A registration accepts a zero-value window that a genesis rule forbids but runtime doesn't

    On-chain registry module

  22. HighInfrastructure exposure

    A debug and profiling surface is exposed with no authentication on a default interface

    Oracle node (plugin runtime)