research collection7 posts

~/blog/findings

Real Vulnerability Findings

Root-cause writeups and public evidence from real smart contract vulnerabilities, contest findings, disclosures, and bounty work.

2026-06-05private workbounty triage

Private Bug Bounty Triage: Validating and Reproducing Web3 Findings

A concise breakdown of my private triage workflow: validating Web3 findings, writing deterministic PoCs after triage, and packaging clean impact evidence without leaking client details.

read more
2026-02-11cairocve writeup

The Ghost Owner — How a Forgotten State Variable Could Resurrect Ownership from the Dead

A deceptively simple vulnerability in OpenZeppelin's Cairo contracts that could let an attacker reclaim ownership of a contract the entire world believed was ownerless.

read the full story
2026-04-02suiupgrades

The Upgrade Trap — How Versioned Objects Can Brick Protocols on Sui

Sui's Versioned wrapper lets protocols migrate shared objects across upgrades. But the same pattern creates an upgrade trap — if your immutable package depends on a versioned protocol, one migrate() call bricks you forever.

read more
2026-02-23aptosreal bug

Field Order Is Sort Order — How Struct Layout Silently Breaks Ordered Maps in Move

Move compares structs lexicographically by field declaration order. If you use a struct as a key in an ordered map, the first field dominates sorting — not the field you think matters. A real bug from Decibel Exchange's perpetual futures DEX on Aptos.

read more
2026-02-22movepattern

The Silent Killer in Move: How return vs abort Silently Corrupts State on Chain

A real bug from Aptos core's trading engine that permanently deleted orders on an "error" path. The root cause? A return where there should have been an abort. Applies to both Aptos and Sui Move.

read more
2026-02-14aptos1H + 1M · 3rd place

The Move Bug That Would Have Bricked Aave on Aptos Before Day One

A case study from Aave Aptos V3 on Cantina, where Panther placed 3rd with 1 confirmed High and 1 confirmed Medium. The High came down to data being stored at one address and read from another.

read more
2026-02-12contestsplaybook

How to Win a Public Contest: Lessons from 6× Top 3 Finishes

Zero fluff, pure trenches-tested insights from climbing to the top 50s on Cantina. This is the alpha that actually moved the needle — not theory, not vibes, just what works when you're deep in the code at 3 AM and the leaderboard is watching.

read more