// independent security researcher

SHADOW-0

Smart contract security researcher focused on DeFi protocols. Building systems that find what automated scanners miss. Every finding backed by mathematical proof. Zero false positives. Zero noise. Only signal.

Focus

DeFiEVM

Approach

Manualreview

Standard

H/Conly

False Positives

0target

◆ Protocol Security◆ EVM Analysis◆ DeFi Auditing ◆ Invariant Testing◆ Formal Verification◆ Oracle Manipulation ◆ Flash Loan Vectors◆ Cross-Chain Security◆ Governance Exploits ◆ MEV Extraction◆ Signature Replay◆ Proxy Collisions ◆ Protocol Security◆ EVM Analysis◆ DeFi Auditing ◆ Invariant Testing◆ Formal Verification◆ Oracle Manipulation ◆ Flash Loan Vectors◆ Cross-Chain Security◆ Governance Exploits ◆ MEV Extraction◆ Signature Replay◆ Proxy Collisions

01 // Approach

shadow@audit ~

$ audit --target protocol.sol

[READ] Mapping trust boundaries ........ done

[READ] Tracing value flows .............. done

[HUNT] Checking state transitions ...... 3 suspicious

[HUNT] Verifying access controls ....... 1 suspicious

[PROVE] Tracing with concrete values .... 2 confirmed

[GATE] Kill checklist applied ........... 2 survived

═══════════════════════════════════════

FINDINGS: 2 High

KILLED: 2 candidates (out of scope, by design)

STATUS: READY FOR SUBMISSION

═══════════════════════════════════════

02 // Threat Classification Matrix

TC-001

Vault Inflation

CRITICAL · ERC-4626

TC-002

Oracle Staleness

HIGH · CHAINLINK

TC-003

Flash Loan Attack

CRITICAL · AAVE/BAL

TC-004

Rounding Exploit

HIGH · MATH

TC-005

Proxy Storage Clash

CRITICAL · UUPS

TC-006

Cross-Contract Reentry

CRITICAL · EVM

TC-007

Missing Slippage

HIGH · DEX/AMM

TC-008

Signature Replay

CRITICAL · EIP-712

TC-009

Governance Takeover

CRITICAL · DAO

TC-010

MEV Sandwich

HIGH · MEMPOOL

TC-011

Bridge Liveness

CRITICAL · L2

TC-012

Token Mismatch

MEDIUM · ERC-20

04 // Operating Principles

⚡

HIGH / CRITICAL ONLY

No informational clutter. No severity inflation. If it doesn't threaten user funds, it doesn't ship. Every report is a weapon-grade finding.

∑

MATH OR NOTHING

Every finding traced with concrete uint256 values. No "could theoretically happen." Prove it with numbers or kill it. The PoC compiles or the finding dies.

☠

ZERO FALSE POSITIVES

2 proved findings beat 10 unproven candidates. Kill checklist applied to every candidate. If doubt exists, the finding dies. Precision over volume.