Posts
15 postsResearch, findings, and vulnerabilities along the way.
2026
18 Zero-Days and a CTF: Is Responsible Disclosure Dead?
The ethicality of putting 18 zero-days into a CTF. A recap of NNS CTF 2026
dyslexic: The missing permission check
A missing guest-side authorization check in Linux's VirtualBox shared-folder driver
Skill Issue
Your router. Your route. Your responsibility. 0x vs Uniswap over v4 hooks
CVE-2026-89094: NNS CTF 2026 and critical 0days
How a critical Forgejo RCE became a 0day challenge at NNS CTF 2026
Findings in the Solidity Compiler
A deep dive into Solidity compiler miscompilations
Zero Day, Zero Click, Zero Balance
Draining Octra wallets
Minting Money and Draining Wallets with Zero Clicks
Everybody dreams of turning a ZK verifier into a money printer
Crashing Anvil's OP Deposit Parser
Casting integers is easy to get wrong. One missing bounds check is all it takes
Unsafe Integer Casts in Anvil's JSON-RPC Handler
Five overflow panics across Anvil's RPC surface: gas limits, base fees, block counts etc
Opinions Are Not Vulnerabilities
My take on automated vulnerability research with AI
Starknet Is Zcash, Aztec Is Monero
The oldest debate in privacy coins is playing out again in L2s
2025
2024
Equinor CTF 2024
Writeups and first blood on two challenges at Equinor CTF 2024
The Cost of Complexity and Ownership
Two CodeHawks contests, two high-severity findings, both selected for the final report
Why You Should Care About Zero-Knowledge Proofs
How zero-knowledge proofs let us verify claims without collecting the private data behind them