Smart Contract Security Review
Manual review of Solidity code, access control, state transitions, external calls, and protocol-specific attack surfaces.
I help DeFi teams assess smart contract risk, test critical protocol invariants, and engineer fixes before important deployments, upgrades, and integrations. My work focuses on EVM / Solidity systems, Foundry testing, and practical protocol risk analysis.
Smart contract risk depends on the code, protocol design, and assumptions behind a system. My focus is hands-on EVM engineering and security testing that makes those assumptions easier to inspect.
I work with Solidity, Foundry, protocol testing, and vulnerability reproduction. I aim to make review work actionable: explain the risk, show evidence where feasible, and help developers understand and validate a fix.
The projects below are public engineering prototypes and testnet demonstrations. They show my approach and learning process; they should not be mistaken for independent production audit reports.
A testnet wallet prototype exploring signature-based authorization, daily spending limits, and guardian recovery. It is account-abstraction-inspired and should not be presented as a complete ERC-4337 implementation unless the required EntryPoint and user-operation flows are implemented.
An ERC-4626-style staking vault prototype with a reward distributor, documented Foundry invariant testing, and Sepolia testnet deployments. The repository also describes limitations that would need to be addressed before production use.
A learning-focused security project demonstrating selected vulnerability patterns through exploit scripts, attacker contracts, and automated tests. The examples demonstrate research and testing practice, not a production audit track record.
A learning-focused lab for reproducing selected smart contract vulnerability patterns and testing example mitigations. Each demonstration should be assessed within its own assumptions and is not evidence of a production audit.
A repository-scanning tool intended to flag selected suspicious scripts, network activity, wallet interactions, and potentially risky patterns. Results are triage signals, not a guarantee that a repository is safe or malicious.
A prototype for explaining Solana transaction errors and logs with AI-assisted suggestions. Suggested fixes should be reviewed and tested before use.
Manual review of Solidity code, access control, state transitions, external calls, and protocol-specific attack surfaces.
Unit tests, fuzz testing, and invariant testing to exercise critical properties under documented assumptions.
Review of vault accounting, token interactions, privileged roles, reward logic, and trust assumptions.
Reproducible examples, fix recommendations, regression tests, and technical walkthroughs for agreed findings.
Build minimal demonstrations of selected vulnerability patterns and validate example mitigations with tests.
Develop and test smart-contract prototypes with clear scope, assumptions, and known limitations.
Preparing an EVM protocol for deployment, an upgrade, or a new integration? I can discuss a scoped security review covering agreed contracts, threat assumptions, targeted testing, documented findings, remediation guidance, and retesting of agreed fixes. Scope and deliverables are agreed before work begins; no review can guarantee that a system is exploit-proof.
To start, share the protocol or repository, the upcoming milestone, the contracts in scope, and your target timeline. Engagement pricing depends on scope, complexity, and delivery requirements.