Independent Security Researcher | prev @GuardianAudits | $3B+ secured • 50+ audits • 15+ bounties
Portfolio & Contact →
Joined July 2022
- Tweets1K
- Following321
- Followers3.2K
- Likes3.4K
👀
Announcement of an announcement:
We'll soon, quite soon, publish our most comprehensive open-source contribution to the @Stacks ecosystem yet.
Stay tuned!
Kiki retweeted
You can't mark a valid High/Critical issue as a duplicate of an "invalid" bug that wasn't fixed.
That's a scam.
Kiki retweeted
1/2
We recently completed a security review for @GraniteBTC, a Bitcoin liquidity protocol built on @Stacks enabling users to borrow stablecoins against Bitcoin collateral through sBTC, developed by @trustmachinesco.
This engagement focused on reviewing fixes, hardening efforts, and protocol enhancements across the protocol’s lending system, covering changes across borrowing, liquidation flows, staking, governance, LP incentives, oracle integrations, withdrawal logic and related core functionality.
Granite combines Bitcoin-backed liquidity access with design choices such as isolated collateral, soft liquidations, and Bitcoin-native infrastructure.
Happy to support teams building BTCfi infrastructure. Always a pleasure working with security-oriented teams pushing the ecosystem forward.
Kiki retweeted
Two of my projects were selected for the @thedaofund Ethereum Security QF Round on @Giveth.
The round has a 500 ETH matching pool (roughly $1M+) backing around 100 Ethereum and L2 security projects.
It uses Quadratic Funding, which means $1 from 100 donors unlocks far more from the matching pool than $100 from 1 donor.
Voting is open until May 14. Here's what they do 🧵
Kiki retweeted
2/ The Ethereum Security Subsidy Program is proud to be launching with access to 20+ of the leading audit providers active in the Ethereum ecosystem:
@AdevarLabs, @bailsecurity, @BlockSecTeam, @Certora, @chain_security, @cyfrin, @dedaub, @GuardianAudits, @hackenclub, @HackenProof, @Hashlock_, @hexens, @immunefi, @LeastAuthority, @lethalspoons, @NethermindSec, @Quantstamp, @QuillAudits_AI, @rv_inc, @SecurityOak, @sherlockdefi, @spearbit, @statemindio, @zellic_io, and @zokyo_io.
These top-tier security providers make the program possible through their commitment to support Ethereum mainnet.
Kiki retweeted
1/2
One of the more detail oriented articles we've published, but the value it brings is significant.
As an auditor, it's interesting to see how one account can map to different addresses on Stacks, depending on whether you're on testnet or mainnet.
xitter.cf/CybaSecurity/status/20…
1/2
When we launched Cyba in February, we said to judge us by what we publish, how we review code, and the standards we hold ourselves to.
We're continuing on that path by publishing security content that benefits the ecosystem.
We're starting with a deep dive into Stacks principal (address) derivation and standard network checks.
For those who may not know, @Stacks is the leading Bitcoin L2, where we have extensive experience securing protocols.
Kiki retweeted
Cross-chain bridges remain critical infrastructure, proof verification is the core of their security model.
New disclosure on our research page: a vulnerability in the Polygon Plasma bridge that allowed transaction proofs to be forged.
At the time of discovery, $800M in POL was at risk, exploitable in a single transaction with no prerequisites.
The research covers how the proof verification breaks, how the exploit was built, and what it means for bridge security.
Full technical deep-dive: hexens.io/research/polygon-b…
Kiki retweeted
Solid work by @silverologist, @czm_alex and myself.
Always good to work on systems at this level with @AccountableData.
xitter.cf/CybaSecurity/status/20…
We've completed our security audit for @AccountableData, reviewing an extension to their DeFi credit vault infrastructure.
Accountable is a key player operating at the intersection of DeFi and TradFi.
Their vault-based credit layer programmatically allocates capital across lending strategies, with over $160M deployed to generate risk-adjusted yield.
They are also building the Data Verification Network (DVN), a privacy-preserving infrastructure that verifies financial data directly at the source. It already secures $1B+ in assets across partners like Galaxy, Amber Group, and K3 Capital, positioning Accountable at the intersection of onchain finance and institutional reporting.
Security at this scale is never a one-off.
Kiki retweeted
1/2
Thanks @web3sec_news for the shout-out🙏
We currently provide EVM and @Stacks (Clarity) security reviews, with scope and capabilities expanding over time.
xitter.cf/web3sec_news/status/20…
For specialized security reviews of EVM or stack-based Bitcoin L2 based projects, check out @CybaSecurity. Hit them up if you are building.
Seeing all of the blockchain/dlt bounty awards posted makes me think two things.
1. I really should expand beyond smart contract level security
2. How have there not been more blockchain level hacks?
Maybe I’m out of the loop but what’s wrong with an unpaid internship? And how many better options are there?
- Contest are scarce and I don’t see that trend changing.
- bounties can be a headache for those that are successful let alone people that are just starting out.
- Contracting gigs without a network or portfolio are few and far between.
Obviously if you can make any of the above three work then it’s a no brainer go do that.
But if I started my career in 2026 instead of 2022 I would strongly consider an internship. The value of working through the entire lifecycle of an audit, learning from experienced auditors, building up a portfolio isn’t worthless. It’s actually pretty valuable
Excited to see a great friend and an amazing auditor start his own firm! Truly @abarbatei is one of the most thorough auditors I’ve worked with!
1/3
Cyba Blockchain Security is now live.
Cyba (pronounced sai-ba) is a researcher-led blockchain security firm focused on manual audits, deep protocol reviews and practical security research.
Founded by @abarbatei, with 10+ years of security experience across Web2 and Web3.
cybasecurity.io
This was the best bounty experience I’ve ever had.
Not only were they quick to fix the issue and had no issue offering a very fair resolution
But they were ultra responsive. Sending consistent updates on where they were at on their end and proactive in resolving any bottlenecks!
The complete opposite of some other protocols I’ve dealt with where at best resolving your report is not a priority, and at worst they are actively trying to get out of resolving the report.
The ones that make security a priority like the one here I’ll 100% come back to their bounty program again and again and again
