Cairo Security Researcher & Starknet Auditor
I’m Panther, an independent Cairo security researcher with a public OpenZeppelin disclosure and Starknet contest experience. My Cairo work focuses on contract state, access control, and the assumptions that connect an administrative action to the state users actually rely on.
Ownership, authority, and state transitions
A Cairo review needs to follow who can invoke each transition, what state remains afterward, and whether later calls can undo the intended security boundary. Two-step ownership, upgrades, staking state, and cross-contract interactions deserve lifecycle analysis rather than isolated function checks. For bridge and cross-chain scopes, the review must also account for authorization, message handling, and how remote state is trusted.
Relevant work and public evidence
I independently disclosed the OpenZeppelin Cairo OwnableTwoStep issue published as CVE-2024-45304. A pending owner could accept ownership after renunciation because pending ownership had not been cleared. OpenZeppelin fixed the cleanup in v0.16.0. My portfolio also records Starknet Staking contest results of one High, one Medium, and one Low, plus ArkProject and Chakra contest work.
- The Ghost Owner: OpenZeppelin Cairo CVE-2024-45304
- Starknet and Cairo competitive audit record
- Independent disclosures and bounty findings
What does the OpenZeppelin disclosure demonstrate?
It provides a public example of tracing an access-control invariant across multiple calls: renouncing ownership was expected to end administrative control, but a previously pending owner retained a path back in. The linked writeup documents the root cause, affected lifecycle, and fix, with links to the public advisory.
Work directly with an independent researcher
Send your ecosystem, repository or documentation, approximate scope, and target dates. I work directly with protocol teams and contribute to security-firm engagements. We agree on the scope, deliverables, and disclosure terms before review; private reports stay private unless publication is permitted.
Discuss your audit scope with Panther or inspect the complete portfolio.