security

I audit blockchain systems, primarily Zero-Knowledge proving infrastructure (zkVMs, circuits, recursion layers) and DeFi protocols.

This page collects the security-relevant work I do: the professional audits I've contributed to, the certifications and coursework I've completed to keep my toolkit sharp, the CTFs I compete in, and the ERC standards work I propose upstream. Hover the  next to a section title for what it means.

security audits In a security audit, a client hires an independent firm to review their code for vulnerabilities before (or soon after) it ships. Findings are documented with severity ratings, prioritised, and published as a report. Each entry below links to the public report.

ZisK zkVM — Binary & Main circuits review

 OpenZeppelin

ZisK (0xPolygonHermez/zisk) · Nov 2025

Scope: PIL2 constraints for the ZisK zkVM: binary opcode circuits (binary.pil, binary_add.pil, binary_extension.pil, binary_extension_table.pil, binary_table.pil) and the main execution trace (main.pil)

ZisK is a general-purpose zkVM — a virtual machine that produces a zero-knowledge proof of any RISC-V program's execution. This engagement reviewed the core PIL2 arithmetic circuits (binary opcode evaluation and the main execution-trace constraints that stitch execution segments together). Thirteen issues surfaced, including one critical — see the public report below.

1 critical2 high1 medium3 low4 info
Public report Code Notes →

certifications & coursework Public certificates of completion for security- and smart-contract-focused courses I've taken. Each badge links to the course page; the Verify link goes to my public Cyfrin Profile so the completion can be confirmed by anyone.

CTFs CTFs (Capture The Flag) are competitive security challenge events — teams attack deliberately vulnerable code under a time limit, scoring points per flag captured.

team CTF events In-person, team-based competitions — typically run during conferences. Each row shows the team, the final rank out of the total number of teams, and (where relevant) the peak rank we reached during the competition.

1 event
  • Wonderland CTF 2026 · Cannes, France · 2026
    9 / 34 peak 3
    Team Stack Too Deep · Adrià Torralba-Agell, Pol Ureña Heras, Gianfranco Bazzani, Ezequiel Pérez, Rubén Cruz Acevedo
    Wonderland's on-site CTF during EthCC 9 in Cannes. Smart-contract security challenges (Solidity + EVM). The 9/34 badge is the final rank; peak 3 was our best standing during the event.

standards work Implementations of Ethereum ERC standards that I propose upstream to open-source smart-contract libraries, together with the security analysis behind their design. Each entry links to the public pull request and states its review status.

  • ERC-7535 Native Asset Vault for OpenZeppelin Contracts — PR #6624, merged on 21 Oct 2026 (milestone 5.8). It implements ERC-7535, the native-ETH variant of the ERC-4626 tokenized vault, as a thin extension of OpenZeppelin’s ERC4626. To make that possible, deposit and mint became payable in ERC4626 behind an _enablePayableDeposit hook that is off by default, so ERC-20 vaults keep rejecting native value, and totalAssets prices shares against the pre-deposit balance. The design notes cover the msg.value policy, refunding excess value only after shares are minted (an earlier refund would let a reentrant caller redeem existing shares at an inflated price), and the _decimalsOffset overflow bound. The tests include reentrant receivers that observe the share price during the mint refund and the redeem payout.