security

I audit blockchain systems, primarily Zero-Knowledge proving infrastructure (zkVMs, circuits, recursion layers) and DeFi protocols.

This page collects the security-relevant work I do: the professional audits I've contributed to, the certifications and coursework I've completed to keep my toolkit sharp, and the CTFs and wargames I practise on. Hover the  next to a section title for what it means.

security audits In a security audit, a client hires an independent firm to review their code for vulnerabilities before (or soon after) it ships. Findings are documented with severity ratings, prioritised, and published as a report. Each entry below links to the public report.

ZisK zkVM — Binary & Main circuits review

 OpenZeppelin

ZisK (0xPolygonHermez/zisk) · Nov 2025

Scope: PIL2 constraints for the ZisK zkVM: binary opcode circuits (binary.pil, binary_add.pil, binary_extension.pil, binary_extension_table.pil, binary_table.pil) and the main execution trace (main.pil)

ZisK is a general-purpose zkVM — a virtual machine that produces a zero-knowledge proof of any RISC-V program's execution. This engagement reviewed the core PIL2 arithmetic circuits (binary opcode evaluation and the main execution-trace constraints that stitch execution segments together). Thirteen issues surfaced, including one critical — see the public report below.

1 critical2 high1 medium3 low4 info
Public report Code Notes →

certifications & coursework Public certificates of completion for security- and smart-contract-focused courses I've taken. Each badge links to the course page; the Verify link goes to my public Cyfrin Profile so the completion can be confirmed by anyone.

CTF & wargames CTFs (Capture The Flag) are competitive security challenge events — teams attack deliberately vulnerable code under a time limit, scoring points per flag captured. Wargames are the self-paced equivalent: public challenge sets with structured levels. Team CTFs and solo wargame progress are tracked separately below because they carry different signal.

team CTF events In-person, team-based competitions — typically run during conferences. Each row shows the team, the final rank out of the total number of teams, and (where relevant) the peak rank we reached during the competition.

1 event
  • Wonderland CTF 2026 · Cannes, France · 2026
    9 / 34 peak 3
    Team Stack Too Deep · Adrià Torralba-Agell, Pol Ureña Heras, Gianfranco Bazzani, Ezequiel Pérez, Rubén Cruz Acevedo
    Wonderland's on-site CTF during EthCC 9 in Cannes. Smart-contract security challenges (Solidity + EVM). The 9/34 badge is the final rank; peak 3 was our best standing during the event.

The Ethernaut OpenZeppelin's Solidity-based wargame. 40+ on-chain levels deployed to Sepolia; each level is a smart contract with a planted vulnerability. Solving a level means crafting the transaction sequence that exploits it.

18 / 41 solved · 1 in progress · last solved May 3, 2026
0 Hello Ethernaut○○○○○1 Fallback●○○○○2 Fallout●○○○○3 Coin Flip●●○○○4 Telephone●○○○○5 Token●●○○○6 Delegation●●○○○7 Force●●●○○8 Vault●●○○○9 King●●●○○10 Re-entrancy●●●○○11 Elevator●●○○○12 Privacy●●●○○13 Gatekeeper One●●●●○14 Gatekeeper Two●●●○○15 Naught Coin●●●○○16 Preservation●●●●○17 Recovery●●●○○18 MagicNumber●●●○○19 Alien Codex●●●●○20 Denial●●●○○21 Shop●●○○○22 Dex●●○○○23 Dex Two●●○○○24 Puzzle Wallet●●●●○25 Motorbike●●●○○26 DoubleEntryPoint●●○○○27 Good Samaritan●●●○○28 Gatekeeper Three●●●○○29 Switch●●●●○30 HigherOrder●●●●○31 Stake●●●○○32 Impersonator●●●●○33 Magic Animal Carousel●●●○○34 Bet House●●○○○35 Elliptic Token●●●●○36 Cashback●●●●○37 Impersonator Two●●●●○38 UniqueNFT●●●○○39 Forger●●●○○40 NotOptimisticPortal●●●●○
solved in progress not started
difficulty (●●●○○ = 3/5): ●○○○○ beginner ●●○○○ easy ●●●○○ medium ●●●●○ hard ●●●●● expert

Damn Vulnerable DeFi (v4)

Coming soon…

Foundry-based DeFi security wargame by @tinchoabbate. 18 challenges modelled on real DeFi bugs — flash loans, oracle manipulation, upgrade bypasses. Solve each one by writing a Foundry test that reaches the target state.

Coming soon…