About.
Independent AMM security researcher.
01 — Background
I studied Computer Science and spent my early career building and debugging medical imaging software. Working on systems where defects have real-world consequences taught me to think through every failure path and edge case, and that mindset transferred naturally to security work.
Web3 security was the field that stood out to me the most. Reading about how hundreds of millions of dollars are being stolen in DeFi hacks every year caught my attention because of how much is at stake in this space. What interested me even more was how often such large losses resulted from a subtle mistake in logic or accounting.
I started competing in smart contract security contests and took first place in Balancer v3, then again in Pike Finance / Tapio. Both were AMM protocols, and that’s where my focus has been since. I’ve also judged four contests on Cantina and completed thirteen private audits, most of them on AMM and DEX systems.
02 — Why AMMs
AMMs combine mathematical models with internal accounting and complex state transitions, which leaves a lot of room for subtle failures. The risk of an exploit worsens as the underlying system interacts with the rest of DeFi (vaults, routers, aggregators, oracles, weird tokens, and other integrations). These bugs are caught by having a deep understanding of how the mechanisms of the protocol are supposed to behave.
The value of specialization is that the knowledge compounds after each review. Although many AMMs may use different curves and architectures, most of the ways they fail are variations of problems I’ve seen before. A deeper understanding allows me to spend more of the engagement testing assumptions and edge cases rather than first having to build that understanding.
03 — How I work
Design review
I begin with the documentation, architecture, and intended behavior of the system, mapping the protocol’s invariants and the conditions under which they must hold. I clarify these with the team early, since inconsistencies between the intended design and implementation are often where the first findings come from.
Manual review
I review the entire codebase line by line across multiple passes, identifying vulnerable components, trust assumptions, and potential failure paths along the way. The goal here is to understand the system deeply enough to spot behaviors and interactions that may have been overlooked during development.
Fuzzing and harnesses
Fuzzing is especially useful for finding subtle edge cases in AMM protocols. I build custom harnesses around individual subsystems so the fuzzer can reach meaningful states and test the invariants identified during the review.
I use Medusa for fuzzing, alongside AI-assisted workflows to accelerate harness construction, scan for additional attack paths and edge cases, and improve coverage. Anything surfaced through these workflows is manually investigated and validated.
Report
Every finding is ranked by severity, from critical to informational, with reproduction steps and remediation guidance. High and critical findings include a proof-of-concept exploit.
Fix review
Each finding is verified to ensure it has been properly remediated and that the changes haven’t introduced any new issues.
04 — What I’m building
Weekly research breaking down AMM mechanisms, security issues, and real-world exploits to learn from.
I’m also working toward structured training for aspiring AMM security researchers. There’s plenty of material on Solidity and general smart contract security, but far less on the AMM fundamentals that make these systems difficult to audit.
Send your repo and target timeline, and I’ll review the scope and confirm availability.