The person behind the pipeline

I'm an independent security researcher. I build automation that hunts for smart contract bugs, then I run it against live DeFi protocols and write down what actually happened. This site is the open version of that work, numbers, costs, dead ends, and all.

What I built

The pipeline takes a target protocol, pulls its contracts, runs a layered review across many model passes, then filters thousands of raw signals down to a short list worth a human's time. The dashboard on this site walks the whole funnel, from raw findings to the few that clear a submission gate. None of it is theory. Every campaign on the board ran against a real, in-scope program.

Plenty of it didn't work. Stable, heavily audited features kept producing duplicates of bugs that paid researchers had already reported. The win came from pointing the same method at beta features with no CVE history, where being early actually matters. That kind of lesson is the reason I keep the failures in the reports instead of polishing them out.

One part matters more than people expect. A finding only pays if a human reads the writeup and acts on it, so I draft each report and run it through BeLikeNative until it reads like a person wrote it, not a model. Clear beats clever when a triage team is deciding whether your bug is real.

What you can use here

Everything below is free to read. Start with the command center for the live picture, then drop into any campaign for the raw tables.

Get the full research data

I don't sell the dataset on its own. The full finding tables, the raw scans, the prompts, and the per-protocol notes all come with a lifetime membership on zovo.one. The membership is the only way to get the research behind this case study, and it includes every other tool I build.