001
Sui Signed Oracle
oracle security reviewSui Move signed-oracle protocol review; implementation details and findings remain private.
Three Sigma
private report
~/work/private
The work behind the reputation.
Private client audits, firm-side delivery, and formal verification across Move · Rust/Solana · EVM — dated, attributed to the commissioning firm, and linked to a published report wherever disclosure allows.
- 34 engagements in this ledger
- 7 partner security firms
- 9 publicly readable reports
- 2025→ continuous delivery
#01 engagement_profile
What 34 engagements look like
// every figure below is a tally of the rows on this page · each split sums to exactly 34
where the work happens
34 scopes
- EVM — Solidity, Vyper16
- Move — Sui, Aptos, Movement10
- Rust / Solana5
- Move + EVM in one scope1
- Stack confidential2
Two of these engagements also carried a formal verification component, and one was verification only — three total. See the proofs ↗
who commissioned it
7 firms
- Pashov Audit Group15
- Adevar Labs6
- Three Sigma5
- Sherlock4
- Cyfrin · Accretion · BurraSec3
- Direct with the client1
Firms re-book auditors they trust. Six of the seven sent more than one scope, and the longest relationship spans fifteen engagements.
what can be shown
34 entries
- Published report — read it now9
- Partially disclosed2
- Private report, client named17
- Fully NDA-protected5
- In progress — details withheld1
A private report should not make the experience invisible. Every row below is real work; only the deliverable is withheld.
systems reviewed
lending
perpetuals
orderbook / CLOB
liquid staking
restaking
yield vaults
AMM / DEX
stablecoins
tokenized RWA
bridging
NFT marketplace
launchpad
bonding curves
account abstraction
crowdfunding
DePIN
prediction markets
deployment review
# engagement_explorer
Find the experience you need
// one query across all 34 engagements · protocols, stacks, firms, systems, and years. Confidential rows stay in the count — the record is complete even where the deliverable is not.
Showing all 34 engagements
Filters and search compose, and each year hides itself when nothing inside it matches. Type a year (2025), a system (vault, oracle), or a firm name.
No matching engagement. Try another stack, system, firm, or year.
#02 engagement_ledger
Private work, made legible
// newest first where engagement months are public · confidential dates are marked, never guessed · repeat and multi-part reviews are consolidated into one record
Confidential by default. Specific where permitted.
Client names and reports appear here only where disclosure is already authorized. “Private report” means the deliverable stays under NDA; “NDA-protected” means the client is withheld too. References and redacted work samples can be shared during scoping.
$ ls ~/audits/private/2026/ 11 engagements
002
Movement MoveProtocol security review; implementation details and findings remain private.
Sherlock
private report
003
prediction marketsSui Move protocol security review; implementation details and findings remain private.
Three Sigma
private report
004
Infini Finance
stablecoinMultichain stablecoin expansion spanning L2 minting, staking, redemption, and bridging — message integrity, oracle freshness, ERC-4626 correctness, and reserve-to-supply reconciliation.
Three Sigma
NDA-protected
005
Mentat Minds BtLending
lendingBittensor lending: TAO liquidity, subnet collateral, dual-EMA oracles, liquidation, trim, and deregistration settlement.
BurraSec
NDA-protected
006
WaterX
perps · predictionPerpetuals, prediction markets, and backed credit with mint/redemption flows and Wormhole bridge support.
Adevar Labs
007
ORO Protocol
tokenized RWAGold-backed RWA infrastructure — protocol accounting, asset flows, and privilege boundaries.
Adevar Labs
008
Aspan Finance
yieldYield-protocol accounting, privileged actions, state transitions, and external integrations.
Adevar Labs
private report
009
Matrixdock xAUM
tokenized RWATokenized-gold RWA and cross-chain flows, including asset accounting and privileged paths.
Cyfrin
010
SpiceNet Delegate
delegationManual security review plus protocol invariants and authorization properties specified in Certora CVL.
Pashov Audit Group
private report
011
CrunchDAO
DAO · data marketData-marketplace and DAO infrastructure, with attention to authorization and asset movement.
Accretion
private report
$ ls ~/audits/private/2026/.month-withheld/ 3 engagements
012month confidential
Edel Finance
deployment reviewDeployment-script correctness, initialization, ownership transfer, configuration, and integration safety.
Adevar Labs
private report
013month confidential
Current Sui
lendingLending invariants and access-control properties modeled and proved with Certora's Sui Prover.
Sherlock
014month confidential
Decibel
perpetualsPerpetuals trading engine: order lifecycle, margin, liquidation, risk logic, and protocol-critical formal properties.
Sherlock
private report
$ ls ~/audits/private/2025/ 18 engagements
015
Yei Finance
lendingAave-derived lending system: reserve configuration, accounting, and privileged operations.
Pashov Audit Group
private report
016
LayerBank
lendingLending and borrowing: collateral, interest, liquidation, oracle, and market-state transitions.
Sherlock
private report
017
Abyss
yield vaultsYield aggregation, vault accounting, strategy boundaries, and Sui object-ownership flows.
Three Sigma
private report
018
Modus
confidentialPrivate protocol review; implementation details and deliverables remain client-confidential.
Pashov Audit Group
NDA-protected
019
Regnum Aurum
tokenized RWATokenized real-world asset acquisition and the contract-level trust boundaries around it.
Pashov Audit Group
020
DeepBook
orderbook · marginDecentralized CLOB with margin and leverage: orderbook, risk, accounting, and PTB composition.
Three Sigma
private report
021
Play AI
confidentialPrivate protocol review; implementation details and deliverables remain client-confidential.
Pashov Audit Group
NDA-protected
022
Biconomy
account abstractionSmart-account execution paths, permission modules, and integration boundaries.
Pashov Audit Group
1 M
private report
023
Saffron Lido Vaults
liquid stakingVault and liquid-staking accounting, withdrawals, role boundaries, and integration assumptions.
Pashov Audit Group
1 C1 H1 M2 L
private report
024
PancakeSwap
DEXExchange contracts, swap and liquidity mechanics, accounting, and access control.
Pashov Audit Group
private report
025
StarVault
crowdfundingCampaign lifecycle, token custody, authorization, and settlement flows.
Adevar Labs
2 H9 M8 L
private report
026
HypurrFi
leveraged lendingAave-derived leveraged system and its deployment paths: ownership, proxy wiring, reserve configuration, and initialization.
Pashov Audit Group
2 H3 M2 L
findings disclosed
027
Degen Dice
onchain gamingProtocol accounting, settlement paths, permissions, and adversarial state transitions.
Pashov Audit Group
2 H3 M9 L
private report
028
Funnel
vaults · AMMVault and Uniswap v3-style core integrations: concentrated liquidity, accounting, and state transitions.
Pashov Audit Group
029
Elixir
staking vaultMulti-chain staking-vault mechanics, accounting, permissions, and cross-domain assumptions.
Pashov Audit Group
5 M10 L
read report ↗
030
Elytra
liquid restakingRestaking-vault accounting, share conversion, withdrawal flows, and protocol integrations.
Pashov Audit Group
3 M7 L
read report ↗
031
Rip.fun
NFT marketplaceMarketplace execution, NFT custody, fees, permissions, and adversarial trade paths.
Pashov Audit Group
2 H6 M6 L
read report ↗
032
Noodles
bonding curvesBonding-curve math, token lifecycle, pricing, accounting, and economic edge cases.
Pashov Audit Group
2 M5 L
read report ↗
$ ls ~/audits/private/.date-withheld/ 2 engagements
033privateclient confidential
Cudis
DePINWearable DePIN and health-reward infrastructure, including authorization and token flows.
Directclient engagement
1 M2 L
NDA-protected
034privateclient confidential
star-dot-fun v2
launchpadLaunchpad lifecycle, token creation, authority boundaries, and asset movement.
Adevar Labs
private report
Severity counts appear only where the client has authorized them.
Rows without a count are not quiet reviews — the numbers simply are not mine to publish. Ask during scoping and I will share what the relevant client permits.
Bounty triage, public contest placements, and independent disclosures are catalogued separately.
See the triage record ↗
#03 next_step
Need this depth on your protocol?
// share the repository, target chain, launch date, and the risk areas keeping you up at night · reply within 24 hours with fit, scope, and availability · scoping is free
Book a private review
The ledger above is the argument. If your system looks like one of these — or looks like nothing on this page and that is exactly the problem — send it over and I will tell you honestly whether I am the right reviewer for it.