Field Notes

How things break, and how I built things that don't. Exploit breakdowns, security reviews and project write-ups.

• ExploitNov 9, 2026
  Zero: the b14g heist, minute by minute

  One zero drained 97M CORE. 25 wallets, a Bybit hot wallet, a 42-second race against the pause button, and a hard fork that set three balances to zero.

• ReviewOct 2026
  Double charges and lost receipts in x402 payments

  One issue and two PRs across Dexter, the x402 Foundation and PayAI: what happens when a payment settles but the answer never arrives.

• ReviewOct 2026
  Reviewing Priors, a credit protocol for AI agents

  An independent review that ended in a docs fix and a credit in the protocol's security notes.

• ProjectOct 2026
  Flash Token Protector: catching fake USDT

  51 ways to fake a USDT payment, and a free checker that catches them on BSC, Ethereum and Tron.

• ProjectOct 2026
  When is an unconfirmed Bitcoin payment safe?

  A threat model and detection engine for zero-confirmation payments, tested on mainnet with my own funds.

• Audit contestFeb 2025
  Sherlock contest: Yieldoor

  Six findings in a leveraged-yield protocol, from price-feed manipulation to a reentrancy in fee collection.