Background, timeline, and capabilities.
I break protocols before attackers do.
Independent Web3 security researcher
Independent Web3 security researcher competing on Immunefi, Cantina, Sherlock, Code4rena and Codehawks.
I specialize in blockchain protocol security — L1 daemons, wallets, and on-chain contracts — across Rust, Go, Solidity and C++.
- 2025ORIGIN// HEAD
Went full-time on independent Web3 security research across Rust, Go, Solidity and C++.
- 2025PRIVATE
Privacy-L1 reviews in C++ (Pirate, Firo): P2P/mempool crash paths and a Spark duplicate.
- 2026CONTEST
Jupiter Lend (Code4rena): flashloan-dust accounting DoS in a Solana lending protocol.
- 2026CRITICAL
Utix (Immunefi): an EOA-only withdrawal guard that permanently locks 451 ETH.
- 2026CRITICAL
Zano (Immunefi): unauthenticated RPC that purges the mempool, plus TLS and JWT-replay hardening.
- 2026HIGH
Ontology (private): a self-referential native-invoke argument slips past the cycle detector and crashes nodes pre-auth with a fatal stack overflow.
- 2026DISCLOSURE
Coordinated disclosure of CVE-2026-52734 — an unbounded mempool memory leak in Zebra (Zcash Foundation).
- 2026HIGH
Particl Core (private): an empty anon-input witness stack drives an out-of-bounds read in CheckTxInputs, crashing synced nodes over the default-on anon relay path.
- 2026HIGH
Neo N3 (private): under-priced System.Iterator.Value re-deserializes attacker payloads on every call, exhausting node CPU and stalling block production.
- 2026CRITICAL
Gno (private): unmetered bech32 decode in the address.IsValid native lets one cheap transaction freeze block production for days.
- 2026CRITICAL
MultiversX (private): data-trie key collision that silently deletes committed contract state and makes state roots nondeterministic — an externally triggered consensus halt.