Welcome to my Web3 security audit portfolio, a collection of my independent audits, contest submissions, and research write-ups.
Each entry documents findings, proof-of-concepts, and mitigation recommendations with professional formatting and reproducible tests.
| Title | Platform | Severity | Status | Link |
|---|---|---|---|---|
Float128::toPackedFloat Fails to Promote to L Size When Exponent Is Critically Low |
Code4rena – Forte: Float128 Solidity Library | High | ✅ Valid (Rewarded) | View Report |
Ln::ln() Fails to Validate Negative Inputs, Causing Division-by-Zero Panics |
Code4rena – Forte: Float128 Solidity Library | High | ✅ Valid (Rewarded) | View Report |
| Unauthorized Token Transfer via Insufficient Access Control | Sherlock – Crestal Network | Medium | View Report |
| Title | Platform | Status | Link |
|---|---|---|---|
| Reward Manipulation in Referral Logic | Code4rena – Nudge | ❌ Invalid (Intended Behavior) | View Report |
Even invalid or duplicate findings are kept here for transparency and learning value.
Every false positive sharpens reasoning and pattern recognition.
- Recon & Surface Mapping – Identify actors, roles, trust boundaries
- Code Reading & Control Flow – Trace key invariants, modifiers, and permission logic
- Access Control & Auth Checks – Verify function visibility, role dependencies
- Math, Precision & Overflow – Detect unsafe arithmetic, rounding drift, or precision mismatches
- External Calls & Reentrancy – Locate potential unsafe calls, pull vs. push payment patterns
- State Management & Edge Cases – Simulate abnormal flows (late joins, zero values, skipped states)
- Testing & PoCs – Reproduce behavior via Foundry, Anvil fork, or minimal Solidity harness
- Impact Analysis & Recommendations – Evaluate severity, realism, and potential mitigations
- Rebuilding deep audit workflow using Foundry invariant testing
- Studying high-impact DeFi exploits and real audit reports
- Preparing for upcoming contests
- Writing concise, reproducible case studies for each finding
I’m Z, a Web3 security researcher and Solidity developer with a focus on precision math, access control, and protocol-level logic flaws.
I audit for correctness, realism, and economic resilience, not just syntax.