Cybersecurity researcher and generalist. Smart contract auditing, web application security, AI red teaming, and cloud infrastructure testing. Finding critical vulnerabilities across DeFi protocols, AI/ML platforms, and production systems.
Discovered a mathematical simplification error in a Uniswap V2 TWAP oracle that causes the time-weighted average to always collapse to the current spot price — making the oracle's slippage check a no-op against price manipulation.
Chained three independent flaws — zero minimum supply, permissionless liquidity injection, and ceiling rounding — to prove that transferring 1 wei of shares can claim 100% of a position's underlying value.
Identified an unvalidated fetch primitive in a widely-used AI framework's prompt conversion flow. User-supplied URLs are fetched server-side without destination checks, exposing cloud metadata and internal services.
Found a missing zero-check in a lending protocol's LTV calculation that causes a runtime panic during liquidation. When collateral value hits zero, underwater positions become permanently unliquidatable.
Contributed feature to Warp Terminal ensuring markdown file links respect the user's configured Markdown Viewer preference, with proper fallback behavior.