Smart contract security research_

I am Kurt Landman. I review DeFi protocols and file what I find on Cantina, Sherlock and Immunefi. Everything below links to the platform that judged it. Findings under embargo are not listed, counted, or hinted at.

cantina sherlock immunefi github x [email protected]

01Findings

T3-004

Metric Fixed-E8 Pyth normalization underprices standard Base MOG/USDC and transfers 5.28% of LP principal

oracle normalization
Sherlock · 2026/07

Medium
paid

T3-003

Metric Fixed-E8 synthetic-ratio truncation lets traders take 47.83% of one-sided RSR/cbBTC LP principal

AMM math / rounding
Sherlock · 2026/07

Medium
paid

T3-002

Metric Price velocity guard can be bypassed by splitting a same-block price move

oracle / guard bypass
Sherlock · 2026/07

Medium
paid

T3-001

Morpho Midnight MidnightBundles minUnits check can pass before callback-created loss slashes received credit

callback ordering
Cantina · 2026/06

Low
confirmed

T3-005

Base Azul Title withheld. The platform has not published this finding.

—
Immunefi · 2026/04

Medium
paid

02Building

PolyTraderBot: Polymarket execution, self-hosted. I own the runtime.
PolyTortoise: Slow, risk-aware Polymarket automation in Telegram.
FetchMux: Request multiplexing service.
Svarog Launcher: Launcher product and site. Lead dev.
Bitcoin 09: Chain project and its public site.
Ink & Ivory Artistry: Client build. South Perth nail studio.

03Where I look

Accounting & invariants: Share math, rounding boundaries, drift across repeated operations.
AMM & curve math: Reserve manipulation, fee-on-transfer, behaviour at the bounds.
Oracles & price paths: Staleness, sequencer downtime, decimal handling.
Access & roles: Escalation, unrevoked approvals, missing revoke paths.
Upgrade & lifecycle: Initialisation, storage layout, what stays live after an incident.
Standards conformance: ERC-20, ERC-2612, and deviations that break interop.

04Contact

A repo, a commit range, a chain address, and what you are worried about is enough to start. If it is not a fit I will say so in one reply.

[email protected]