Skip to content

Victor Okpukpan — Smart Contract Security Researcher & Developer. Think like the attacker, report like the defender.

Black hat · Offence

Thinklike theattacker.

09
Contests
7
High
9
Med
4
Low
White hat · Defence

Reportlike thedefender.

Victor Okpukpan. Smart contract security researcher and developer. I audit EVM protocols by hunting the assumptions they rest on.

Request a review Read the findings
§ The method

Four moves. Every finding came out of them.

01 — Assumption

Start with what the code believes.

Every function is written against a picture of the world: which tokens arrive, how large numbers get, who calls first. I list those beliefs before reading a single branch, because the code only enforces the ones its author remembered to check.

Symmio — Staking & Vesting
H-01·high
The assumption
“Reward tokens behave like 18-decimal tokens.”
What broke
Reward-per-token is accrued with 18-decimal fixed-point maths. Fund the pool in USDC (6 decimals) with a large staked supply and each increment is smaller than one unit, so integer division truncates it to zero.
Impact
Stakers earn nothing while the distribution looks funded.
elapsed * rate * 1e18 / totalSupply // → 0 for USDC
Stakers may receive no USDC rewards due to precision loss in reward accrualWriteup
02 — Invariant

Turn each belief into a rule that must never break.

An assumption becomes testable once it is phrased as an invariant: something that has to hold after every transaction, in any order. Then I go looking for the ordering that breaks it.

Liquid Ron
H-01·high
The assumption
“Two users who withdraw the same amount pay the same price per share.”
What broke
Harvest books the operator fee but leaves the ETH inside the vault until someone manually fetches it. Until then, totalAssets() counts money that doesn’t belong to depositors.
Impact
Whoever withdraws before the fee is fetched burns fewer shares than whoever withdraws after. The exchange rate depends on timing.
sharesBurned(before fetch) < sharesBurned(after fetch)
Delayed operator-fee collection gives earlier withdrawers a better share price than later onesWriteup
03 — Exploit path

Follow the value across the whole system.

The serious bugs rarely sit on one line. They show up where two modules each do something reasonable and the combination is wrong, so I trace value through every contract it touches, from mint to repay.

RAAC
H-04·high
The assumption
“The debt index is applied exactly once.”
What broke
DebtToken.mint() reads balanceOf, which is already scaled by the normalised debt, and then multiplies by the old and new index again to compute accrued interest.
Impact
Borrowers are charged interest they never accrued, and repayment accounting drifts protocol-wide.
balanceOf(user).rayMul(index) // index applied twice
Double debt-index multiplication overestimates debt when minting debt tokensWriteup
04 — Report

Write it so the fix is obvious.

A finding is only worth something if the team can act on it. Each one names the root cause and the concrete impact, and ends with the smallest change that closes it. RAAC came to twelve.

RAAC12 findings
high·4medium·5low·3
  1. H-01RToken mint overestimates interest accrual, letting users receive excess tokens
  2. H-02Token decimal mismatch in ZENO redemption leads to inaccurate USDC payouts
  3. H-03RAACNFT collects ERC20 payments with no way to withdraw them
  4. H-04Double debt-index multiplication overestimates debt when minting debt tokens
  5. M-01RAAC emission rate can be manipulated by cycling StabilityPool deposits
  6. M-02Treasury.allocateFunds has no token parameter, causing allocation tracking errors
  7. M-03calculateDustAmount divides the contract balance by the liquidity index, underestimating funds
  8. M-04DebtToken.totalSupply divides by normalized debt instead of multiplying, underestimating debt
  9. M-05Treasury._totalValue sums raw token amounts across tokens, misreporting holdings
  10. L-01Governance doesn't forward ETH and the TimelockController can't be funded, so ETH proposals fail
  11. L-02RToken.mint returns values in the wrong order versus its NatSpec, breaking integrations
  12. L-03FeeCollector swap-tax and NFT-royalty basis points are 10x too high
The full RAAC report Every contest
§ Build

I also ship. Tools I’d want in an audit.

Callsign

LIVE · 2026

Read what a transaction actually does.

A browser-only EVM calldata decoder. Paste raw hex or a transaction hash and Callsign resolves the function selector, decodes every parameter, and unpacks nested Safe multiSend batches word by word — across six chains, with no wallet and no backend state.

6
Chains
0
Backend state
2
Signature sources
nested
multiSend depth
Read the case study Open Callsign
A Safe multiSend batch unpacked — two sub-transactions, each decoded on its own
Fig. 1A Safe multiSend batch unpacked — two sub-transactions, each decoded on its own
§ Writing

The method, written down.

All research
§ Engage

How a review works. No surprises.

  1. 01

    Scope

    You send the repo, the commit to review, rough size, your deadline and anything you’re worried about. The checklist is pre-filled in the email.

  2. 02

    Quote

    I read enough of the code to scope it properly, then come back with a timeline and a quote before any work starts.

  3. 03

    Review

    A manual, line-by-line review using the method above: the assumptions, the invariants, the paths value takes through the system. Anything critical is flagged as soon as I find it.

  4. 04

    Report & fix review

    Each finding comes with root cause, impact, a proof of concept where it helps, and a recommended fix. Once you’ve patched, I review the fixes.

What to send
  • Project / protocol
  • Repo link
  • Commit hash to review
  • Approximate size (nSLOC)
  • Deadline or launch date
  • Docs or spec
  • Areas you’re most worried about

Not ready to share code yet? Send what you can and we’ll scope from there.

Request a review
Available for engagements

Shipping a protocol? Have an attacker read it first.

Competitive & private audits · Secure smart contract work · Security writing. Before mainnet, or after a scare.

Request a review Telegram