Smart contract audits.Protect the protocol.
Evidence-backed Web3 security audits for DeFi protocols, blockchain clients, bridges, staking systems, wallets, and the infrastructure around them—before attackers find the edge case.
Accounting · Solvency · Access control
Consensus mismatch → invalid state accepted
exploit(surface);
}
Recovery · Availability · Fee mechanics
Verified track record
Measured security impact.
01 / Audit services
Security reviews built around what your protocol cannot afford to lose.
Manual, adversarial review for teams shipping new contracts, protocol upgrades, cross-chain systems, and consensus-critical code. Every engagement is scoped around assets, trust assumptions, and failure modes—not a generic checklist.
DeFi, staking, bridge, wallet, and application-layer security
Solidity, Move, Rust, and Soroban reviews covering access control, accounting, solvency, oracle assumptions, upgradeability, and economic attack paths.
Explore smart contract audits Blockchain security auditsL1, L2, client, networking, and consensus review
Go, Rust, C, and C++ review for state transition logic, execution clients, validator behavior, serialization, networking, and chain-critical invariants.
Explore blockchain security02 / Selected work
Evidence over promises.
Public findings across production blockchain systems, DeFi protocols, wallets, and application layers.
Immunefi
@chinchinbabyExplore my bug bounty research, disclosed findings, and public track record on Immunefi.
View my Immunefi profileZcash security advisories.
Two lightwalletd vulnerabilities, co-reported as iamfadhlu and credited by Zcash. Both fixed in version 0.5.0.
Lightwalletd cancelled block-range streams leak worker goroutines
Cancelled block-range requests could leave workers running, exhausting server resources and disrupting wallet synchronization.
GHSA-9x94-88pq-6v7hRead the Zcash advisorylightwalletd cache can stitch old-fork and new-chain blocks after restart
After a chain reorganization during downtime, the restarted server could combine cached blocks from incompatible forks and disrupt wallet synchronization.
GHSA-pwwg-h8q5-hq28Read the Zcash advisoryXRP Ledger
L1 · C++
MPT transfer fees could cause book offers to misreport funded liquidity.
View public evidenceSomnia
L1 · C++
Client-side WebSocket framing and handshake weaknesses surfaced during audit.
View public evidenceMonad
L1 · Consensus
Consensus accepted blocks with mismatched execution base-fee values.
View public evidenceKuru
CLOB · Solidity
Two accepted findings across the onchain order-book protocol surface.
View public evidenceAave Aptos
Lending · Move
A top-ten finish reviewing a Move-based lending protocol deployment.
View public evidenceCore Contracts
Lending · Solidity
Accounting, solvency, liquidity-index, and boost logic vulnerabilities.
View public evidence03 / Expertise
Systems thinking.Attacker mindset.
From Solidity contracts to validator clients, reviews are built around the invariants that keep value safe—not a checklist of familiar bugs.
Protocol logic
State transitions, invariants, privilege boundaries, and adversarial paths.
Economic security
Oracle assumptions, solvency, liquidations, fee mechanics, and manipulation.
Client & consensus
Execution clients, networking, serialization, and consensus-critical behavior.
Fix verification
Remediation review with clear, reproducible guidance for engineering teams.
Languages & ecosystems
04 / The researcher
fromeo016hacks
fromeo016 is an independent Web3 security researcher focused on breaking protocol assumptions. Public work spans Immunefi, Cantina, Sherlock, Code4rena, CodeHawks, and HackenProof, with accepted findings across lending, L1/L2 infrastructure, staking, DEXs, wallets, and cross-chain systems.
The track record also includes private disclosures covering 5 additional critical, 4 high, and 2 medium-severity vulnerabilities.
Based in Nigeria. Working globally. Direct researcher-to-team communication from scoping through remediation.
Need a security review?
Let’s make the exploit hypothetical.
Share your scope, timeline, and repository. Get a direct response from the researcher doing the work.