001Aug 2026
Sui Signed Oracle
oracle security reviewSui Move signed-oracle protocol review
Three Sigmaprivate delivery
private report
~/work
The work. The evidence.
Explore private reviews, contest findings, bounty triage, and independent disclosures. Every record is visible; use the filters to find experience relevant to your protocol. Working across Move · Rust · Solidity · Cairo · Sway · FunC · Go.
- 80 distinct engagements & programs
- 34 private & firm-side engagements
- 12 top-ten contest finishes
- 10 security firms & platforms
# selected_proof
The work behind the signal.
Three snapshots from the ledger: competitive research, private depth, and production protocol review.
open the full proof explorerAave
Flagship lending protocol research with a public report and actionable findings.
1 H1 Mreported finding set ↗
02 / private depth
Sui · CLOB · leverage
03 / multi-surface
Sui · EVM · bridge
DeepBook
Firm-side review of a decentralized order book with margin and leverage surfaces.
privateThree Sigma deliveryWaterX
Credit, bridge, perpetuals, and prediction-market surfaces across a live protocol suite.
3+systems reviewed ↗# proof_explorer
Explore the full track record
// Search by protocol, ecosystem, firm, or review type; some engagements appear in more than one section.
Showing all 79 portfolio entries
All work is visible by default. Choose a filter or search to narrow the list. Clear filters at any time to return to the full portfolio.
No matching work yet. Try another ecosystem, protocol, firm, or review type.
#02 move_ecosystem
Search and filter portfolio ↑
Move — Sui, Aptos & Movement
// primary focus ecosystem · object model, abilities, capability boundaries, PTB composition
$ ls ~/audits/move/ 14 records
002Aug 2026
protocol reviewMove security review on Movement
Sherlockfirm-side review
003Jul 2026
prediction marketsSui Move protocol security review
Three Sigmaprivate delivery
private report
004
Aave
lendingFlagship lending protocol
Cantinapublic contest
1 H1 M
↗ report
005
DeepBook
CLOB · marginDecentralized central limit order book with margin and leverage
Three Sigmaprivate delivery
private
006Aug 2025
Elixir
staking · vaultMulti-chain staking vault
Pashovprivate delivery
5 M10 L
↗ report
007
Abyss
yieldYield aggregator
Three Sigmaprivate delivery
private
008
LayerBank
lendingLending and borrowing protocol
Sherlockprivate delivery
private
009Jan 2026
Matrixdock
RWA · cross-chainTokenized gold (XAUm) with cross-chain transfer surfaces
Cyfrinprivate delivery
010
Decibel
perpetualsOnchain perpetual futures engine
Sherlockprivate delivery
private
011Jun 2026
WaterX Perps
perpetualsPerpetual futures venue
Adevar Labsprivate delivery
012Jun 2026
WaterX Credit / Bridge
credit · bridgeBacked USDX mint/redeem credit system with Wormhole EVM bridge support
Adevar Labsprivate delivery
013Jun 2026
WaterX Prediction
prediction marketBroker-layer prediction market giving Sui users Polymarket exposure
Adevar Labsprivate delivery
014
Private Move bounty triage
bounty validationFirm-side validation across live bounty scopes; validated findings turned into deterministic reviewer-ready PoCs
Pashovtriage role
#03 rust_solana
Search and filter portfolio ↑
Rust & Solana
// Anchor and native programs · account validation, PDA derivation, CPI boundaries, SPL / Token-2022
$ ls ~/audits/rust/ 8 records
015
Tensor
NFT · AMMSolana NFT marketplace with an automated market maker
Cantinapublic contest
2 H1 M
↗ 3rd place
016
StarVault
crowdfundingCrowdfunding platform on Solana
Adevar Labsprivate delivery
2 H9 M8 L
private report
017
ImpossibleFinance / Rarible
Token-2022 · marketplaceNFT marketplace triage on Token-2022 extensions
Zenithtriage role
2 C1 H
↗ triage
018
star-dot-fun v2
launchpadToken launchpad
Adevar Labsprivate delivery
private
019
Centrifuge
RWAReal-world-asset tokenization infrastructure
Cantinapublic contest
1 M
↗ report
020
Cudis
DePINWearable DePIN with health-data reward accounting
Privatedirect engagement
1 M2 L
private report
021
CrunchDAO
DAO · marketplaceData marketplace and DAO tooling
Accretionprivate delivery
private
022Mar 2026
Oro
RWA · goldGold-backed real-world-asset infrastructure
Adevar Labsprivate delivery
#04 private_audits
Search and filter portfolio ↑
Private Engagements
// delivery as a private or firm-side auditor—not contest participation · eight recent scopes below · the complete 34-entry ledger lives on its own page
- 34private review scopes
- 7partner firms
- 3core ecosystems
- 2025→active delivery
Confidential by default. Specific where permitted.
Client names and public reports appear only where disclosure is already authorized. Private reports stay private; references and redacted work samples are available during scoping.
$ head -8 ~/audits/private/ledger 8 of 34
023
Sui Signed Oracle
oracle security reviewSui Move signed-oracle protocol review; implementation details and findings remain private.
Three Sigma
private report
024
Movement MoveCollaborative protocol security review; final report updated September 14, 2026.
Sherlock
025
prediction marketsSui Move protocol security review; implementation details and findings remain private.
Three Sigma
private report
026
Mentat Minds BtLending
Bittensor lending with TAO liquidity, subnet collateral, dual-EMA oracles, liquidation, and deregistration settlement.
BurraSec
NDA-protected
027
Infini Finance
Multichain stablecoin expansion covering L2 minting, staking, redemption, bridging, and reserve-to-supply reconciliation.
Three Sigma
NDA-protected
028
WaterX
Sui perpetuals, prediction markets, and a backed credit system with EVM/Wormhole bridge support.
Adevar Labs
029
ORO Protocol
Gold-backed RWA infrastructure on Solana, reviewed across protocol accounting and token flows.
Adevar Labs
030date private
Decibel
Aptos perpetuals trading engine — order lifecycle, margin, liquidation, risk logic, and formal properties.
Sherlock
private report
#05 formal_verification
Search and filter portfolio ↑
Formal Verification
// mathematically proving protocol invariants rather than sampling for counterexamples · Certora CVL, Sui Prover, Move Prover
$ ls ~/audits/fv/ 3 records
031
Current Sui
lendingSui DeFi lending protocol — invariant specification and proof
Sherlockprivate delivery
private
032
Spicenet Solidity
delegationSpicenet Delegate contracts — rule authoring and verification
Pashovprivate delivery
private
033
Decibel on Aptos
perpetualsPerpetual futures trading engine — global markets, onchain
Sherlockprivate delivery
private
✓Certora CVL
✓Sui Prover
✓Solidity FV
✓Move Prover
#06 public_contests
Search and filter portfolio ↑
Public Contests
// independent competitive research—not private client delivery · Cantina, Sherlock, Code4rena, CodeHawks · 12 of 19 finished top ten
$ ls ~/contests/ | sort -r 19 records
034Jun 2026
Polygon Heimdall V2
consensus clientPolygon PoS consensus client rewrite
results pendingSherlock
26 accepted
035
Arcade
NFT lending
🥈 2nd place
1 M
036
Aave
Lending on Aptos
🥉 3rd placeCantina
1 H1 M
037
Tensor
NFT AMM
🥉 3rd placeCantina
2 H1 M
038
Velvet v4
Asset management
🥉 3rd place
6 H7 M
039
Venus
Governance
🥉 3rd place
9 L
040
Juicebox
Onchain treasury
🥉 3rd place
2 M8 L
041
RedStone
Oracle
6th place
1 H1 M1 L
042
Chorus One
Staking
7th place
1 H
043
stake.link
Liquid staking
8th place
1 H3 L
044
Bima
Liquity fork
8th place
1 H3 M
045
Starknet Staking
Staking
9th place
1 H1 M1 L
046
Dahlia
DeFi
10th place
4 M
047
Opal
DeFi
12th place
1 H7 M2 L
048
Centrifuge
Real-world assets
12th placeCantina
1 M
049
Farcaster
Social protocol
17th place
2 M
050
MightyFi
DeFi
20th place
6 H3 M
051
ArkProject
NFT bridge
20th place
1 H2 M1 L
052
Chakra
Cross-chain settlement
unranked
2 H
#07 bounty_triage
Search and filter portfolio ↑
Triage & Finding Validation
// firm-side validation role—not an authorship claim for submitted reports · severity validation, PoC reproduction, duplicate consolidation, reviewer handoff
$ ls ~/triage/ · Latest additions first 24 records
Accountable Vaults V2
ZenithTriager
EnteleWALLET — Public Website
Zenith
074
Cap Protocol
stablecoin · lendingBad-debt accounting, liquidation economics, oracle safety, reward settlement, proxy deployment, and async redemptions
ZenithTriager
25 High-severity candidates triaged · exploitability, trust assumptions, duplicates, PoC validity, and realistic severity reviewed
073
Aave V3 Origin
lending marketReserve accounting, oracle, liquidation, incentives, governance/configuration, and upgrade paths
ZenithTriager
internal
38 High-severity candidates reviewed · exploitability, freshness, duplicates, trust assumptions, and realistic severity validated
072
Astros
Perpetuals
PashovTriager / PoC
071
Navi
Lending
PashovTriager / PoC
070
Kai Finance
Lending
PashovTriager / PoC
069
Walrus
Storage infrastructure
PashovTriager / PoC
068
Scallop
Lending
PashovTriager / PoC
067
Aptos — Crypto
Cryptography
PashovTriager / PoC
066
Sui Framework — Staking
Staking
PashovTriager / PoC
065
Sui Seal
Cryptography
PashovTriager / PoC
064
Ladder Markets
DeFiAsynchronous tranche withdrawals
ZenithTriager / Verified / PoC
063
Divvy.bet
bettingTournament CPI and house programs
ZenithTriager / priority review
062
ImpossibleFinance / Rarible
marketplaceToken-2022 NFT marketplace
ZenithTriager / Verified
061
Optimism — Fault Proof
fault proofOP Stack · ~12.5k LOC
Pashov Audit GroupVerified / Triaged
060
Balancer v3
DEX110 contracts · ~25.3k LOC
Pashov Audit GroupVerified / Triaged
059
Royco
yield90 contracts · ~18.4k LOC
Pashov Audit GroupVerified / Triaged
058
Rails (Liquidity Vault)
managed vaultXLM collateral with USDT0 yield accounting
ZellicTriager
internal
2 valid, 1 invalid · PoC-backed notes
057
Lido
liquid stakingEasy Track governance, accounting oracle, council daemon, and validator ejector
ZenithTriager
internal
5 findings reviewed · 1 clear Medium, 4 Low / conditional Medium · PoC-backed validity and severity triage
056
3Jane Money Market
lending · vault · oracleUnsecured credit money market with USD3/sUSD3 vaults and borrower-specific rates
ZenithTriager
internal
4 highest-severity findings reviewed · validity and severity notes
055
Metronome Synth
synthetic assetsCollateralized synthetics, rewards, and cross-chain surfaces
ZenithTriager
internal
Priority finding validation · exploitability and severity review
054
Starknet Privacy
privacy poolPrivacy pool, discovery service, and SDK
ZellicTriager
internal
Triage complete · 4 highest-severity findings reviewed for validity and realistic severity
053
Noise Sequencer
trading sequencerOff-chain sequencer for market, funding, PnL, ADL, withdrawal, and NAV settlement
ZenithTriager
internal
86 findings triaged · 2 High and 40 Medium finalized · duplicates and invalid reports consolidated
#08 bug_bounties
Search and filter portfolio ↑
Independent Disclosures
// my own vulnerability reports to L1/L2 programs · submitted outside any firm engagement
$ ls ~/bounties/ 3 records
076
Decibel
confirmed & rewardedPerpetual futures engine
1 C2 H5 M
private program
077
OpenZeppelin
public · CVE-2024-45304Cairo contracts library
1 M
078
ZKsync Lite
acknowledgedReported as a known issue
1 C
—
Where a row says private, that is the disclosure status — not the depth of the work.
Roughly half this ledger sits behind client confidentiality. References and redacted samples are available during scoping.
security_expertise
Security research by ecosystem and protocol
Explore review scope, relevant findings, and technical writing for your protocol.
Move Security Researcher & Sui / Aptos Auditor
Independent Move auditor for Sui, Aptos and Movement. Explore Panther's Aave finding, private review experience, and Move formal verification research.
Explore experience and research →Rust Security Researcher & Solana Auditor
Panther's independent Rust security research: Solana program reviews, Tensor NFT AMM contest findings, and staking protocol audit methodology.
Explore experience and research →Cairo Security Researcher & Starknet Auditor
Independent Cairo security researcher Panther: OpenZeppelin CVE-2024-45304, Starknet staking contest work, and ownership lifecycle analysis.
Explore experience and research →Independent Solidity Security Researcher & Auditor
Independent Solidity security researcher Panther reviews EVM DeFi. Explore Arcade, Venus, Juicebox and Velvet contest experience and lending audit guides.
Explore experience and research →DEX Security Researcher | AMM, CLOB & Perpetuals
Independent DEX security research by Panther: AMM, order-book and perpetuals review experience across Move and Rust, with protocol audit field guides.
Explore experience and research →DeFi Lending & Borrowing Security Researcher
Panther reviews DeFi lending and borrowing security: Aave Aptos findings, Sui formal verification, collateral, oracles, liquidations and protocol accounting.
Explore experience and research →