Portfolio - Web3 Security Research, PoCs & projects

Practical, reproducible work demonstrating my smart-contract auditing, exploit prototyping research process, build projects and practicing.

Author: kode-n-rolla

Focus on sec/dev:

• Solana / SVM, rust
• Ethereum / EVM, solidity
• build protocols, smart-contract audits, bug-bounty PoCs

Status: Collection of public PoCs, research notes and workshop code. See each sub-project for individual status and disclosure info.

---

TL;DR

This repository collects my practical work: PoC tests (Foundry), short writeups, diagrams and scripts that reproduce vulnerabilities in a forked environment. Each project folder contains a README.md with reproduction steps, disclosure status and how to run the PoC safely on a local fork.

---

Why this repo

• Demonstrates reproducible research, not just theoretical notes.
• Shows the process - triage → hypothesis → forked simulation → PoC → mitigations.
• Useful for validate skills quickly.

---

High level structure

portfolio/
├─ README.md (this file)
├─ codehawks/
│  ├─ >= 12 reports.pdf
│  └─ README.md
├─ cyfrin_updraft_nft_challenges/  
│  ├─ insecure_randomness/
│  ├─ fuzz_testing/
│  └─ reentrancy/
└─ LICENSE

Projects, PoC`s, reports, researching

• shuka - CLI toolkit for exploring and analyzing decentralized applications.
• DeStor - Decentralized protocol for building immutable history registries for real-world assets.
• Solana Token Risk Lens - Explainable Solana token risk dashboard built with Rust, TypeScript and React
• Zombie game - Modern Foundry-based zombie game rebuild with OpenZeppelin, security-oriented tests, and compact MVP architecture..
• Cyfrin Updraft NFT Challenges Solving - completed challenges with Foundry tests and writeups.
• Audit Reports from contests
• Engineering Lab:
  • Solanotes - A compact Solana/Anchor notes program focused on correct PDA design, ownership checks, deterministic account derivation, and testable state transitions.
  • Escrovia - Anchor-based Solana escrow program for trust-minimized SPL token swaps.

Articles

• Damn Vulnerable DeFi - series of audit-style PoCs. Writing about mind process at Hashnode::Damn De-Fi series articles
• CodeHawks - writing about mind process at Hashnode::Codehawks series articles

Responsible disclosure & ethics

• I follow responsible disclosure. If a vulnerability is unpatched at disclosure time, the PoC is kept private until resolved.
• Public PoCs are sanitized to be fork-only (reproducible in a local fork) and include a clear warning.
• If you discover a 0-day via this repo or related research, contact the project maintainers first and follow the vendor’s bounty/disclosure process.

Disclaimer

All code is provided for research and educational purposes only. Do not run exploit scripts on live networks. The author is not responsible for misuse.