Independent Security Research
Smart contract review, EVM internals, application and infrastructure testing. Evidence over adjectives: fork repro, live-state probes, and honest severity calls.
Disclosures and reviews, published only after vendor coordination.
A permissionless deposit path credited the amount advertised in the token transfer event instead of the balance actually received. Fee-on-transfer or rebasing tokens silently break per-asset solvency accounting. Verified with a mainnet-fork reproduction; severity downgraded after scanning 2.04M historical deposits across 3 chains found no affected asset in use.
Automated acquisition, decompilation and finding triage for Android targets: exported-component audits, file-provider traversal, WebView bridges, pinning and root/emulator attestation gaps — with a reproducible harness instead of one-off manual pokes.
When a vendor ships an upstream OSS project unchanged, the interesting bugs live in the deployment layer: configuration drift, exposed admin surfaces, version pinning, and the gap between upstream hardening and what actually runs in production.
Password-reset poisoning, host-header trust, token prediction and MFA-flow gaps chained from a low-severity reflection into full session takeover — proven by reading data as the victim, not by a redirect alone.
Runs entirely in your browser. Nothing is uploaded.
Security reports, triage questions, and coordinated disclosure:
audit@0xasuma.dev
Please include reproduction steps and affected asset/version. Encrypted or signed replies welcome.