Independent security reviewer for DeFi protocols and zkVM integrations.
The deliverable is a private Foundry repo with green forge test output — not a PDF.
- Invariant suites — stateful fuzzing around the identity that actually moves money: receipt ids, epoch indices, match ids, withdrawal cursors, forwarder senders.
- Mainnet-fork tests — against a live deployment or a pinned commit, authorized scope only.
- Upgrade / diff review — a focused pass over what changed after a proxy upgrade or a patch.
- zkVM / coprocessor boundary — guest program plus on-chain verifier binding: image ID pinning, journal commitment, replay resistance.
This is a time-boxed security review, not a security audit and not a guarantee. Terms: SERVICES.md.
| Repo | What it shows |
|---|---|
| split-ledger-vault-demo | Money-moving identity, two shapes: split ledgers and a missing queue cursor. Directed PoCs, then conservation and per-request invariants on the patched vaults. |
| pool-invariant-suite-demo | Two bug classes (first-depositor inflation, performance-fee creep) with directed PoCs, handler invariants with rate-relative rounding bounds, echidna/halmos/slither cross-checks, and a storage-layout drift guard. 32 tests. |
| risc0-onchain-verify-demo | zkVM seam: Rust guest → Groth16 receipt → Solidity verifier. Negative tests for tampered journal, wrong image ID, bad selector — plus pinned replay and seal-malleability behavior, and guest-side rule tests. |
| zkvm-guest-bug-notes | Curated map of guest-program and on-chain binding bug classes, public references only (12 classes, ~45 sources). |
Samples are teaching contracts and notes. They are not findings against a live protocol.
Open for new engagements. Scope, process, and terms: SERVICES.md.
Contact: dersefurkan32@gmail.com · Telegram @FURY_Fn — replies within 24 hours.