Skip to content

Portfolio - Josselin Feist.md

Latest commit

 

History

History
22 lines (14 loc) · 2.79 KB

Portfolio - Josselin Feist.md

File metadata and controls

22 lines (14 loc) · 2.79 KB
Raw

Josselin Feist

About Josselin

Josselin is a Lead Fuzzing Specialist at Perimeter.

He is the author of Slither and a seasoned information security expert with over a decade of experience, including 8+ years focused on blockchain security. Until 2025, he was the Engineering Director of the Blockchain team at Trail of Bits, where he led reviews of some of the most critical systems in the space.

Josselin specializes in securing both cutting-edge DeFi applications and the core blockchain components for not only EVM, but also for Move, Solana, Cosmos, Polkadot, and Algorand protocols. He also holds a Ph.D. in program analysis for security.

Notable Security Review Outcomes

Over the years, Josselin led or contributed to security reviews such as Uniswap V4, Uniswap V3, Balancer V2, Curve, Offchain BoLD and Offchain Nitro. His expertise has helped shape best practices across the blockchain space:

  • Upgradeability Anti-Patterns: Josselin wrote a series of blog posts on smart contract upgrade risks, including “Contract upgrade anti-patterns” and “Good idea, bad design: How the Diamond standard falls short”. These articles aim to help developers avoid common pitfalls when designing upgradable smart contracts.
  • Critical Aave Upgradeability Bug: He discovered a severe vulnerability in Aave’s upgradeable proxy contracts that could have “broken” Aave and affected multiple integrated DeFi protocols. This issue was the result of extensive research he conducted into upgrade mechanisms and proxy design.
  • Arbitrum Nitro L2 Security Review: He led the audit of Arbitrum Nitro, a complex Ethereum Layer-2 rollup. The review involved deep analysis of the L2 state transition function, fraud proofs, and bridging logic.
  • Tezos Message-Passing Vulnerability: He identified and publicly documented critical flaws in Tezos’s message-passing model. This included issues like callback authorization bypass and call injection—bugs that hadn’t been previously identified in the ecosystem.
  • Balancer V2 Audit: As the lead reviewer of Balancer’s V2 codebase, Josselin performed an in-depth analysis of numerical precision issues and authored Appendix H, which covered rounding error impacts. This work directly influenced safer arithmetic practices within the protocol.

External Links