Distributed Ledger & Zero-Knowledge Security Researcher
I audit blockchain protocols for high-impact vulnerabilities, with deep expertise across distributed ledger technology, zero-knowledge systems, protocol design, and smart contract security.
I focus on the classes of bugs that lose funds or break protocol guarantees: flawed accounting and share math, broken invariants, unsafe trust boundaries, and mismatches between an implementation and the DLT or ZK design it claims to uphold. My work spans competitive audit contests and private bug bounty programs, with a track record of confirmed high-severity findings across leading platforms.
- 40+ confirmed public findings across four platforms
- 18 High-severity issues surfaced in competitive audits
- Consistent top-25 finishes in Cantina and Sherlock competitions
| Platform | Public findings | Severity mix | Rank / reputation | Highlights |
|---|---|---|---|---|
| Cantina | 24 | 10 High · 5 Medium · 5 Low · 4 Info | #247 · reputation 60 | 2× Top 10, 4× Top 20 |
| Sherlock | 6 | 4 High · 2 Medium | #1726 | 1× Top 25, 2× Top 50 |
| Immunefi | 6 | Confirmed findings | — | Private bug bounty work |
| HackenProof | 7 | Confirmed findings | — | Private bug bounty work |
| Platform | Contest | Result | Findings |
|---|---|---|---|
| Cantina | Aquarius | #6 / 55 | 8 |
| Cantina | ammalgam-contracts | #10 / 33 | 2 |
| Cantina | telcoin-network | #17 / 92 | 4 |
| Cantina | colorpool-chromia | #13 / 28 | 3 |
| Sherlock | Ammplify | #14 | 5 |
| Sherlock | Burve | #28 | 1 |
| Area | What I look for |
|---|---|
| DLT architecture | Consensus assumptions, validator and sequencer trust, finality, cross-domain state |
| Zero-knowledge systems | Circuit constraints, proof verification, public inputs, soundness and integration risks |
| Accounting & share math | Rounding drift, incorrect conversions, value leakage, insolvency paths |
| Access control & trust boundaries | Missing validation, unsafe assumptions, permission bypasses |
| AMM & liquidity logic | Tick math, pool validation, settlement errors, price-range edge cases |
| Vaults & ERC-4626 flows | Incorrect deposits, withdrawals, migrations, fee and asset accounting |
| Invariants & state machines | Broken lifecycle rules, inconsistent indexes, unreachable or unsafe states |
- Map value flows first. Understand how the protocol moves and accounts for value before hunting individual bugs.
- Validate design assumptions. Confirm the implementation preserves the guarantees of the underlying DLT or ZK design.
- Prove impact. Build minimal proofs of concept when a finding needs demonstration rather than explanation.
- Report with clarity. Every finding states what breaks, who can trigger it, and where value moves.
- Make it reproducible. Back results with tests, traces, and notes so they can be independently verified.
| Layer | Tools & methods |
|---|---|
| Smart contracts | Solidity, Foundry, Hardhat, invariant testing, proof-of-concept development |
| Protocol analysis | DLT architecture review, consensus assumptions, cross-domain state, sequencer and validator trust |
| ZK systems | Circuit review, verifier integration, public-input validation, constraint soundness |
| Automation | Python, TypeScript, custom scripts, trace analysis, research utilities |
| Platform | Handle | Public proof |
|---|---|---|
| Sherlock | 0xpinkman |
audits.sherlock.xyz/watson/0xpinkman |
| Cantina | deltasec |
cantina.xyz/u/deltasec |
| Immunefi | — | 3 confirmed findings |
| HackenProof | — | 7 confirmed findings |