~/blog/findings
Real Vulnerability Findings
Root-cause writeups and public evidence from real smart contract vulnerabilities, contest findings, disclosures, and bounty work.
Private Bug Bounty Triage: Validating and Reproducing Web3 Findings
A concise breakdown of my private triage workflow: validating Web3 findings, writing deterministic PoCs after triage, and packaging clean impact evidence without leaking client details.
read moreThe Ghost Owner — How a Forgotten State Variable Could Resurrect Ownership from the Dead
A deceptively simple vulnerability in OpenZeppelin's Cairo contracts that could let an attacker reclaim ownership of a contract the entire world believed was ownerless.
read the full storyThe Upgrade Trap — How Versioned Objects Can Brick Protocols on Sui
Sui's Versioned wrapper lets protocols migrate shared objects across upgrades. But the same pattern creates an upgrade trap — if your immutable package depends on a versioned protocol, one migrate() call bricks you forever.
read moreField Order Is Sort Order — How Struct Layout Silently Breaks Ordered Maps in Move
Move compares structs lexicographically by field declaration order. If you use a struct as a key in an ordered map, the first field dominates sorting — not the field you think matters. A real bug from Decibel Exchange's perpetual futures DEX on Aptos.
read moreThe Silent Killer in Move: How return vs abort Silently Corrupts State on Chain
A real bug from Aptos core's trading engine that permanently deleted orders on an "error" path. The root cause? A return where there should have been an abort. Applies to both Aptos and Sui Move.
read moreThe Move Bug That Would Have Bricked Aave on Aptos Before Day One
A case study from Aave Aptos V3 on Cantina, where Panther placed 3rd with 1 confirmed High and 1 confirmed Medium. The High came down to data being stored at one address and read from another.
read moreHow to Win a Public Contest: Lessons from 6× Top 3 Finishes
Zero fluff, pure trenches-tested insights from climbing to the top 50s on Cantina. This is the alpha that actually moved the needle — not theory, not vibes, just what works when you're deep in the code at 3 AM and the leaderboard is watching.
read more