Aspiring smart contract auditor building DeFi security expertise through deep protocol analysis. Focused on EVM security, Solidity analysis, and precision math. 2 valid High findings on Code4rena. Currently: Day 21/90 of intensive audit preparation
- 🧩 2 High-Severity Valid Findings (Rewarded) - Code4rena (Forte Float128)
- 🧱 1 Valid Finding - Sherlock (Crestal Network, duplicate)
- ❌ 1 Invalid / Intended Behavior Report - documented for learning transparency
- 🧪 Foundry-based test + PoC workflow
- 🧰 Tools: Foundry · Slither · Aderyn · Anvil · Echidna · Remix · Etherscan
Protocol Deep-Dives: Building security pattern recognition through line-by-line analysis
- ✅ Uniswap V2 (AMM mechanics, K invariant, reentrancy patterns)
- 🔄 Aave V3 (lending, liquidations, health factors)
- 📋 Next: Compound, Curve, Lido
Contest Strategy: Selective participation when protocols align with studied patterns
📊 Progress: Day 21/90 of intensive preparation
Deep-dive into swap(), mint(), burn() with security pattern analysis and architecture diagrams.
Key insights:
- Lock modifier prevents reentrancy across all state changes
- Balance-based calculations prevent spoofing attacks
-
MINIMUM_LIQUIDITYburn prevents donation attacks -
$\Large {k}$ invariant ensures pool integrity
Published: Twitter Thread | 790-line analysis
| Finding | Platform | Severity | Status | Link |
|---|---|---|---|---|
Float128::toPackedFloat Fails to Promote to L Size When Exponent Is Critically Low |
Code4rena – Forte | High | ✅ Valid (Rewarded) | View Report |
Ln::ln() Fails to Validate Negative Inputs, Causing Division-by-Zero Panics |
Code4rena – Forte | High | ✅ Valid (Rewarded) | View Report |
| Unauthorized Token Transfer via Insufficient Access Control | Sherlock – Crestal Network | Medium | View Report | |
| Reward Manipulation in Referral Logic | Code4rena – Nudge | – | ❌ Invalid (Intended Behavior) | View Report |
👉 See full portfolio: z0L-audits
- Recon & Architecture Mapping: Identify trust boundaries and actor roles
- Static Review: Analyze state transitions and access modifiers
- Dynamic Testing: Foundry fuzz + invariant testing, mainnet forks
- Exploit Simulation: Model realistic attack paths
- Impact Analysis: Evaluate severity, risk exposure, and cascading effects
- Reporting: Clear PoC, rationale, mitigation, and lessons learned
| Domain | Tools / Frameworks |
|---|---|
| Security & Auditing | Foundry · Slither · Aderyn · Anvil · Echidna |
| Languages | Solidity · TypeScript |
| Analysis | Etherscan · Tenderly · Remix |
| Documentation | Markdown · Obsidian |
Building audit expertise through systematic protocol analysis:
Tier 1: Core DeFi Primitives (May - Oct 2026)
- ✅ Uniswap V2 (Constant Product AMM)
- 🔄 Aave V3 (Lending & Liquidations)
- Compound V2 (Simpler Lending - Comparison Study)
- MakerDAO (CDP Mechanics & Oracles)
- Curve (StableSwap Invariant)
- Lido (Liquid Staking)
Tier 2: Advanced Patterns (2027)
- Uniswap V3/V4 (Concentrated Liquidity & Hooks)
- GMX V2 (Perpetuals)
- Synthetix (Derivatives)
Each deep-dive includes: architecture diagrams, security pattern analysis, attack vectors, and Foundry PoCs.
By July 2026:
- ✅ Deep-dive 6 core DeFi protocols (Uniswap, Aave, Compound, Maker, Curve, Lido)
- ✅ Participate in 5+ high-quality audit contests (selective focus)
- ✅ Study 3+ major DeFi exploits with working PoCs
- ✅ Active Twitter presence sharing learnings
By December 2026:
- 🎯 Land junior auditor role or apprenticeship
- 🎯 Published technical write-ups on AMM & lending security
- 🎯 Contribute to open-source audit tooling
“Precision is security.”
— z0L
I believe secure code is the byproduct of clarity, not just caution.
Every function should explain why it’s safe, not just assume it.
🛡️ Always learning. Always breaking (ethically). Always improving.