Rust + SolanaZK + MPC
Crafts–Arcium Fundraising Program
A published review of a privacy-focused fundraising program using zero-knowledge circuits and secure multiparty computation.
Read the published report ↗Services
Specializations
EVM (Ethereum Virtual Machine)
I’ll review application and execution-layer assumptions in Solidity or related EVM code, depending on the repository and threat model.
Review surfaces
- Authorization, roles, upgradeability, and emergency controls.
- External calls, callbacks, value flow, storage, and accounting.
- Execution assumptions, low-level boundaries, and malformed-input behavior.
Zero-Knowledge Circuits
I’ll trace a circuit from its intended statement through witness generation, proving, verification, and the host-code boundary.
Review surfaces
- Constraints, witness assignments, public inputs, and soundness boundaries.
- Transcripts, Fiat–Shamir challenges, commitments, and proof binding.
- Verifier behavior and assumptions shared by prover, verifier, and host code.
Applied Cryptography
I’ll connect cryptographic design assumptions to the implementation and the protocol boundary, including FHE and MPC systems where they are in scope.
Review surfaces
- Primitive composition, parameter choices, keys, nonces, and randomness.
- Serialization, domain separation, transcript binding, and API misuse.
- FHE/MPC trust boundaries and assumptions that cross implementation layers.
Related reading
L1s, L2s, and Rollups
I’ll follow state and message flow across the network, execution environment, bridge, and settlement boundary rather than treating each component in isolation.
Review surfaces
- State transitions, validation logic, sequencing, and settlement assumptions.
- Messaging, bridge paths, replay protection, and finality boundaries.
- Precompiles, resource limits, malformed inputs, and denial-of-service surfaces.
Related reading
DeFi Primitives
I’ll model the invariants and economic assumptions that make a financial primitive safe under normal use, edge cases, and adversarial state transitions.
Review surfaces
- Accounting invariants, access control, and asset custody.
- Oracle and pricing assumptions, liquidity, solvency, and liquidation paths.
- Rounding, precision, fee calculations, and state-transition edge cases.
Solana
I’ll focus on Solana’s account and runtime invariants, with scope defined around the program, supporting clients, and cross-program interactions.
Review surfaces
- Account ownership, signer checks, PDAs, seeds, and authority transitions.
- CPI boundaries, serialization, arithmetic, and runtime-specific assumptions.
- State initialization, account confusion, and malformed instruction handling.
Formal Verification, Static Analysis, and Fuzzing
I’ll use manual review alongside automated techniques when the repository, test harnesses, and threat model support them. These methods supplement review; they do not replace understanding the system.
Review surfaces
- Security invariants, property tests, and stateful behavior.
- Static-analysis findings, fuzzing targets, harness quality, and input boundaries.
- Formal or invariant reasoning for security-critical transitions and verifier logic.
Related reading
Cosmos
I’ll trace Cosmos module behavior through message validation, deterministic execution, and interoperability boundaries.
Review surfaces
- Module and message validation, state ownership, and deterministic transitions.
- Panics, unbounded computation, arithmetic, serialization, and resource limits.
- IBC or other interoperability assumptions where they are in the review scope.
Related reading
Related published firm reports
Firm-published reports kept separate from individually attributed independent reviews. Individual auditor attribution may not be available.
Public findings and analyses
Technical write-ups and disclosures published with direct source links.
zkVMTranscript security
LeanMultisig transcript failures
Analysis of transcript-collision and state-handling failures in a Fiat–Shamir backend.
Read the analysis →Layer 2Validator logic
GOAT slash-fraction validation bypass
Analysis of a validation failure that allowed negative slashing behavior and validator-accounting abuse.
Read the analysis →NoirCompiler
Repeated array literal denial of service
A compiler denial-of-service finding where repeated array literals can expand into a massive abstract syntax tree.
Read the Noir finding ↗Competitive platform records
Contest submissions and platform records, separate from commissioned independent reviews. Cantina and HackenProof destinations may require platform authentication.
Private-review context
Some technical review work is covered by confidentiality terms. Client names, private reports, and outcomes are not published here; additional experience can be discussed privately where appropriate.
Bug-bounty triage and validation roles
Programs where the role was report triage or validation, not authorship of every submitted finding.