I break and fix smart contracts.
Focused on EVM security, Solidity analysis, and precision math in DeFi systems.
Actively auditing, while developing PoCs and independent case studies.
- 🧩 2 High-Severity Valid Findings (Rewarded) — Code4rena (Forte Float128)
- 🧱 1 Valid Finding — Sherlock (Crestal Network, duplicate)
- ❌ 1 Invalid / Intended Behavior Report — documented for learning transparency
- 🧪 Foundry-based test + PoC workflow
- 🧰 Tools: Foundry · Slither · Aderyn · Anvil · Echidna · Remix · Etherscan
| Finding | Platform | Severity | Status | Link |
|---|---|---|---|---|
Float128::toPackedFloat Fails to Promote to L Size When Exponent Is Critically Low |
Code4rena – Forte | High | ✅ Valid (Rewarded) | View Report |
Ln::ln() Fails to Validate Negative Inputs, Causing Division-by-Zero Panics |
Code4rena – Forte | High | ✅ Valid (Rewarded) | View Report |
| Unauthorized Token Transfer via Insufficient Access Control | Sherlock – Crestal Network | Medium | View Report | |
| Reward Manipulation in Referral Logic | Code4rena – Nudge | – | ❌ Invalid (Intended Behavior) | View Report |
👉 See full portfolio: z0L-audits
- Recon & Architecture Mapping: Identify trust boundaries and actor roles
- Static Review: Analyze state transitions and access modifiers
- Dynamic Testing: Foundry fuzz + invariant testing, mainnet forks
- Exploit Simulation: Model realistic attack paths
- Impact Analysis: Evaluate severity, risk exposure, and cascading effects
- Reporting: Clear PoC, rationale, mitigation, and lessons learned
| Domain | Tools / Frameworks |
|---|---|
| Security & Auditing | Foundry · Slither · Aderyn · Anvil · Echidna |
| Languages | Solidity · TypeScript |
| Analysis | Etherscan · Tenderly · Remix |
| Documentation | Markdown · Obsidian |
- 🕵🏽 Expand audit catalog
- ✍🏽 Publish monthly write-ups on logic & math vulnerabilities
- 🧑🏽💻 Land a Web3 Security Auditor / Smart Contract Engineer role
- 🔬 Contribute to open-source audit tooling
“Precision is security.”
— z0L
I believe secure code is the byproduct of clarity, not just caution.
Every function should explain why it’s safe, not just assume it.
- GitHub: z0Ld3v
- Twitter/X: @z0Ld3v
- Email: Proton
- Portfolio: z0L-audits
🛡️ Always learning. Always breaking (ethically). Always improving.