About

Protocol research

On-chain audits of what protocols actually deliver. Most recently a study of PrivacyCash: roughly 100,000 program signatures sampled, from which 7,140 deposit-to-withdrawal pairs turned out to be uniquely linkable on timing and amount alone, with no attack on the cryptography at all.

Smart contracts

Sentel, an m-of-n multisig vault live on Solana mainnet, holding real user funds. I wrote the Anchor program and the frontend: two vault types, portfolio rebalancing through Jupiter V6, and a proposal lifecycle where nothing moves without a threshold of owners approving it. I went back over the deployed program afterwards and found five paths where one owner could act outside what the others had approved, including two that let a single owner hand the vault to an arbitrary Jupiter route. All five are fixed, with regression tests that fail against the old code.

Shred-level infrastructure

A Rust pipeline that reads Solana shreds off the UDP layer and decodes swap instructions before they surface through RPC. Meteora DLMM is wired up today, with DAMM v2 and Pump AMM decoders written. Built to measure how much of the orderflow picture is reconstructable ahead of the public interfaces.

Bare-metal systems

ssd-wipe-os, a freestanding x86_64 kernel in Rust with no operating system underneath it, built toward issuing NVMe and ATA sanitize commands directly. Overwriting an SSD from userspace does not erase it; wear levelling and over-provisioning mean the only reliable erase is the one the controller performs on its own media.