Skip to content
Ethereum security — contests · CTFs · tooling · writing

Security research

Adversarial thinking, applied. I re-implement protocols to understand them, fuzz them to break them, and write up what I find.

01Training & practice

Guild Audit Academy — Security Research Fellowship

4-month intensive · 2025

A fellowship focused on producing senior blockchain engineers and security researchers through hands-on coding, security exercises, and weekly code reviews.

  • Re-implemented the MasterChef staking protocol in pure Yul (assembly)
  • Deep-dived and re-implemented Uniswap V2 from scratch
  • Advanced patterns: proxies, clone factories, metamorphic contracts
  • Unit and property-based testing (fuzzing) methodologies

02Professional audits & contests

Blockchain Security Researcher — 33Labs

May 2026 → Now · Uniswap Foundation whitelisted service provider

Client audit work at a Web3 security and engineering firm — manual analysis and advanced tooling across DeFi protocols and Uniswap v4 hooks.

Engagements
  • Private smart-contract audits for client protocols
  • Client reports publish here as disclosure allows

Contest record — every finding public and verifiable.

Sherlock: @superdevfavour C4: @The_Amazing_One
High4
Medium5
  1. HighstNXM LP share price can be flash-manipulated to overpay withdrawing/entering usersstNXM · Sherlock · #50 (opens Sherlock report in a new tab)
  2. HighUnrestricted pool creation (non-ERC-20 tokens) breaks core protocol functionalitySuper DCA · Sherlock · #26 (opens Sherlock report in a new tab)
  3. HighUsers can claim cashback for trades that pre-date the cashback programSuper DCA · Sherlock (opens Sherlock report in a new tab)
  4. HighAttacker can reset the reward clock, causing permanent reward loss for stakersSuper DCA · Sherlock (opens Sherlock report in a new tab)
  5. MedMalicious matcher can steal protocol feesIndex Fun · Sherlock · #15 (opens Sherlock report in a new tab)
  6. MedstNXM oracle can get stuck and revert on normal early price movesstNXM · Sherlock (opens Sherlock report in a new tab)
  7. MedMissing timestamp reset in staking contract leads to reward theftSuper DCA · Sherlock (opens Sherlock report in a new tab)
  8. MedMarking a backup makes recovery impossible — recover list never queried (Rust)Swafe · Code4rena · #26 (opens Code4rena report in a new tab)
  9. MedLaunchToken transfers cause staking rewards to be lost to the LaunchpadGTE · Code4rena (opens Code4rena report in a new tab)

9 valid findings · best finish #15 · 4× top-50

03CTF & wargame record

04Security tooling

BlockSploit — AI on offense

An AI-driven security tool that autonomously identifies and exploits smart-contract vulnerabilities. In active development.

PythonSolidityJavaScript

Analysis stack

  • SlitherStatic analysis
  • Echidna · MedusaFuzzing
  • Foundry FuzzProperty testing
  • AderynStatic analysis

05Writing