Full-Stack Blockchain Developer · Smart Contract Security Researcher
Building production systems · Breaking them on purpose · Cyfrin grad
Full-stack blockchain developer and smart contract security researcher with 5 years of engineering experience — 4+ years building across the entire Web3 stack since 2022, with a deliberate security-focused shift since 2025.
My background spans EVM and non-EVM ecosystems — Solidity, Cairo, Rust, Leo (Aleo), TypeScript — giving me end-to-end system intuition that single-chain developers lack. I understand how protocols are architected from every layer, which sharpens how I find where they break.
One of the few developers who can read and reason about ZK-native smart contracts on Aleo, FHE-based confidential computation via Fhenix CoFHE, and Account Abstraction (ERC-4337) patterns across multiple ecosystems.
cyfrin grad → Puppy Raffle · ThunderLoan · TSwap audit exercises . Boss Bridge audit
codehawks → 3 First Flights (ThunderLoan · Snowman Airdrop · Festival Pass)
4 valid findings · 3 High · 1 Medium
dvdf v4 → all 18 challenges solved — flash loans · oracles · governance
proxy vulnerabilities · ABI encoding · CREATE2 · L2 bridges
exploit classes → flash loan attacks · reentrancy · ERC-2771 spoofing · arbitrary calldata
governance/snapshot manipulation · oracle manipulation (spot · TWAP · V3)
Safe wallet supply chain exploitation · storage slot collision · ABI smuggling
defi mechanics → AMM constant-product · LP mint/burn · swap routing · flash swap callbacks
CREATE2 pair addressing · TWAP oracle design · concentrated liquidity (V3)
Merkle distributions · L2 bridge mechanics · Curve stableswap
tools → Foundry · Slither · Aderyn · Echidna · Hardhat
platforms → Sherlock · HackenProof · Immunefi · Codehawks · Guardian
Actively competing — updated after every contest
4 valid findings across 3 Codehawks First Flights · 3 High · 1 Medium
| # | Contest | Platform | Valid findings | Severity | Date |
|---|---|---|---|---|---|
| 1 | ThunderLoan (First Flight) | Codehawks | 2 | 2 H: deposit() accepted as a substitute for repay(), storage collision on upgrade |
2026 |
| 2 | Snowman Airdrop (First Flight) | Codehawks | 1 | 1 H: malformed EIP-712 MESSAGE_TYPEHASH breaks all wallet-signed claims |
2026 |
| 3 | Festival Pass (First Flight) | Codehawks | 1 | 1 M: off-by-one in redeemMemorabilia supply cap |
2026 |
| 4 | Alt Fun | Guardian | — | Live contest, in progress | 2026 |
Codehawks reports are private; findings above were matched against the judged answer keys. Public PoCs and write-ups are coming.
| Project | Description | Stack |
|---|---|---|
| DVDF v4 Solutions | All 18 challenges solved — flash loans · oracles · governance · proxies · ABI smuggling · L2 bridges | Solidity · Foundry |
| audit-puppy-raffle | Cyfrin curriculum audit — reentrancy · randomness manipulation | Solidity |
| audit-thunderloan | Cyfrin curriculum audit — oracle price manipulation · fee logic | Solidity |
| Project | Description | Chain | Stack |
|---|---|---|---|
| Veilance | Privacy-first freelancing platform with ZK milestone escrow · | Aleo | Leo · Next.js · Supabase |
| MindCast | Decentralized podcast platform — live mainnet deployment (registry, ERC-20, staking) | 0G Chain | Solidity · Next.js |
| Sealect | FHE-powered confidential decision platform — vendor selection, blind review, KYC gate, private payments | Arbitrum | Solidity · FHE · Next.js |
| Neroworks | Decentralized freelance marketplace with Account Abstraction and Paymaster for gasless onboarding | Nero Chain | Solidity · Next.js · AA |
| Conviction Matrix | Real-time institutional signal engine — 9 live API modules, EIP-712 order signing, trade execution | EVM | TypeScript · ethers v6 |
| dFreelancer | Fully on-chain decentralized freelancing platform | Ethereum | Solidity |
| DAO dApp | Decentralized Autonomous Organisation | Ethereum | Solidity · Next.js · TS |
| icp-lottery | On-chain lottery | ICP | Rust |
Smart contract languages
-6B21A8?style=flat-square){kind=icon}
-4B0082?style=flat-square){kind=icon}
Web & backend
Security tools
| Layer | Skills |
|---|---|
| Smart contracts | Solidity · Cairo · Rust · Leo (Aleo) · FHE (Fhenix CoFHE) · Account Abstraction (ERC-4337) · Paymaster |
| Frontend | Next.js · React · TypeScript · Ethers.js · Wagmi · Viem · Starknet.js |
| Backend | Node.js · Express · PHP · Laravel · TypeScript SDKs · MCP servers |
| Databases | MySQL · MongoDB · PostgreSQL · Supabase |
| Infrastructure | REST APIs · GraphQL · LAMP · MERN |
- ✅ Completed Damn Vulnerable DeFi v4 — all 18 challenges solved with full audit reports and PoCs
- ✅ Placed 4 valid H/M findings across 3 Codehawks First Flights
- 🏆 Live contest on Guardian (Alt Fun); actively competing on Sherlock · HackenProof · Immunefi · Codehawks
- 📖 Reading audit reports daily on Solodit.xyz
- 🔐 Deepening fuzz testing with handler-based invariant testing
- 📝 Building in public
"The best auditors aren't just bug hunters — they're builders who understand how things break."
Open to: Private audits · ZK security research · Contest collaborations · Full-stack blockchain consulting