Contact
Aerial view of rows of data center backup generators at dusk
Case studies

Security work,
shown in detail.

Photo: Rsparks3 · CC0 1.0

Each case study walks through a target, the techniques used, every finding with its severity and evidence, and the verified outcome.

About these case studies. Client engagements are confidential, so none are shown here. Every case study here is an educational demonstration: a purpose-built vulnerable system with a fixed counterpart. The lab code and tests ship with this site, and every outcome reported here comes from running them.

Educational demo
Web3

First-Depositor Inflation in an ERC-4626-Style Vault

A vault that prices shares from its own token balance lets an attacker capture the next deposit with a 1-wei position and a donation.

3 findings · 2 test-verifiedCase study
Educational demo
Web3

Cross-Function Reentrancy in a Staking Contract

A guarded withdraw function and an unguarded transfer function share state. The attacker re-enters the one nobody locked.

1 finding · 1 test-verifiedCase study
Educational demo
Web3

Spot-Price Oracle Manipulation in a Lending Pool

Collateral priced from a single AMM's reserves can be inflated inside one transaction with borrowed capital.

2 findings · 1 test-verifiedCase study
Educational demo
Web Applications

Broken Object-Level Authorization in a Multi-Tenant API

An invoicing API checks that you are logged in, but not that the invoice is yours. One parameter change crosses tenants.

2 findings · 2 test-verifiedCase study
Educational demo
Web Applications

JWT Algorithm Confusion in an Authentication Service

A verifier that trusts the token's own `alg` header can be convinced to check an RSA public key as an HMAC secret.

2 findings · 2 test-verifiedCase study
Educational demo
Infrastructure

SSRF Validation and Metadata Exposure in a Link-Preview Service

A string-matching URL filter misses most ways of writing an internal address. Paired with permissive instance settings, that is a path to cloud credentials.

3 findings · 3 test-verifiedCase study
Educational demo
Infrastructure

CI Secret Exposure via `pull_request_target`

A workflow that checks out untrusted pull-request code in a privileged context hands repository secrets to any fork.

3 findings · 3 test-verifiedCase study
Educational demo
Research

Signature Replay Across Deployments, Chains and Encodings

An off-chain authorization scheme without a nonce or a complete EIP-712 domain lets one signature be spent again and again.

3 findings · 3 test-verifiedCase study
Start a conversation

Let's discuss your security needs.

Tell us what you're building. We'll respond with clear questions, an honest view of whether we're the right fit, and a scoped proposal if we are.

Discuss an Assessment Our Methodology