What fuzzing LpdFi taught me
What fuzzing LpdFi taught me about writing harness objectives, sizing loans against spot oracles, and the protocol patterns to check in an audit.
pyk
Security Researcher
Latest posts
rvm.fork instead of --rpc-url
I removed CLI fork flags from ripfuzz (prev raptor) and moved forking into a cheatcode.
Migrating cmdtest from Zig 0.15 to 0.16
The Zig 0.16 release brought a complete I/O system redesign. Here is my experience migrating `cmdtest`, including the new Child process API, file operations, and what I had to learn along the way.
Coverage-guided fuzzing with revm
How I built the coverage inspector for raptor. Five signals that distinguish different behavior, and how to collect them with revm's Inspector trait.
Replacing my revm ForkDB background thread with SharedBackend
My old ForkDB Client used a background worker thread, crossbeam channels, and a panic supervisor. I replaced it with SharedBackend, which needs no background thread and is much easier to reason about.
Making checkrs 17x faster
My Rust linter was taking 5 seconds to lint 75 files. Here's how I got it down to 300 milliseconds.
Security Audit Review: A Reward Accounting Bug in Stakehouse
I'm reviewing past audit findings to build a personal checklist for future audits. This post analyzes a reward accounting bug in Stakehouse where old stakers could steal new deposits.
Writing a mockable Filesystem trait in Rust without RefCell
I needed to test my CLI tool without writing to disk. I started with a messy `RefCell` setup but refactored it to use proper Rust borrowing instead.
Trying Out SIMD & SWAR in Zig
Experimenting with low-level optimizations in Zig. I wrote a benchmark to race SIMD vectors against bit-twiddling hacks for skipping JSON whitespace.
Writing a Type-Safe Linux Perf Interface in Zig
I'm building a benchmarking tool for Zig and needed CPU counters. This is how I wrapped Linux's `perf_event_open` to be type-safe with comptime.
Fixing Zig benchmark where `std.mem.doNotOptimizeAway` was ignored
I spent a while debugging a benchmark that was impossibly fast. Turns out LLVM is too smart. I fixed it by forcing runtime reads with volatile.
Fixing Zig Microbenchmark Accuracy
Measuring execution time under `1ns` is hard. This post covers how I fixed accuracy issues in my Zig tool by running the function in batches.
I Accidentally Kept a Pointer to the Stack in Zig
A classic stack-use-after-return bug I ran into with Zig. I was trying to be clever and pass a reader by reference, but ended up with a dangling pointer.
Memory Allocation in Zig: Reading `stdout`
Working on `cmdtest`, my Zig CLI testing tool, I ran into the problem of reading `stdio` from long-lived processes. This is my dive into why memory allocation is key for handling program output.
Brainstorming "Zig Object Validator" API
My journey designing a Zod-like validation library in Zig. A dive into `comptime`, type generation, and the trade-offs for good tooling support.
cmdtest v0.2.0
I'm sharing my experience building `cmdtest`, a Zig package for testing CLI apps. This post covers Zig I/O, comptime vs runtime, and `build.zig` import quirks.
Building VS Code Extensions with Bun and Mise
My notes on building a VS Code extension using Bun and Mise. Covers build scripts, tasks, and a macOS fix for zsh `PATH` issues.
Fixing the Unresolved Dynamic Import in Astro
Vite's bundler was too smart for its own good and kept failing my dynamic import in Astro. This is the one-line trick I used to outsmart it.
Fixing Astro's 'Import Declaration Conflicts' Error
I hit an 'Import declaration conflicts' error in Astro. My page and a component had the same name. Here's how I fixed it with an import alias.
My Strategy for Winning
I'm building a custom security research env in VS Code to find more bugs, integrating Foundry and Medusa to make my workflow faster.
A Plan Is Not a Strategy
My takeaways from a Roger Martin HBR video on plan vs. strategy. It showed me I was making to-do lists instead of figuring out how to win.
Tracking Pagefind Search with Umami
I wanted to see what people search for on my site. Here's how I connected Pagefind to Umami with a simple `MutationObserver` trick.
envfmt v1.0.0
I just released envfmt v1.0.0. The big change was removing all dependencies to make it a tiny, stable lib. Here are my notes on the update.
Intersection Observer over Scroll Listener
My site's navbar felt janky with a scroll listener. I fixed it with the Intersection Observer API. Here's how I used it for a smoother scroll effect.
My Custom Code Block Setup in Astro
My notes on extending Astro's code blocks. I wrote a Shiki transformer to read metadata from the code fence and a rehype plugin to add the UI.
Why Fonts Look Crispier on iOS
I was annoyed that my site's font looked different on my iPhone and Mac. The fix was one simple Tailwind class antialiased. Here's why it works.
git-gen Dev Log #1
I'm building a CLI to write better git commits. This is my dev log on getting the first messy, working version up and running with Gemini.
Site Cleanup
Decided to get back to basics with this site. I removed a bunch of old sections and code, and now it's just plain HTML/CSS with system fonts.
xdgdir v0.8.0
I got sidetracked building a tool and ended up writing a tiny Rust crate to find XDG paths. These are my notes on how I built xdgdir.
envfmt v0.1.0
I needed to expand environment variables for another project, so I built my first Rust crate. This is my log on envfmt and using traits for testing.
Cap Fuzzing Campaign
My notes when fuzzing the Cap protocol
Solidity Parser
My notes on solidity parser
Ammalgam Fuzzing Campaign
About
Security Researcher
Welcome to my website
Security Researcher
Projects
Security Researcher
Remix SWR
Figuring out caching mechanism for my Remix app. This post is my personal cheat sheet for setting SWR headers for real-time, daily, and static data.
Fix "inflate failed" in ClickHouse JS
I ran into a "inflate failed buffer error" with ClickHouse.js. The fix was easy, check if my data arrays have items before trying to insert them.
Fix "driver: bad connection" in golang-migrate ClickHouse
Spent a bit debugging a `bad connection` error with golang-migrate and ClickHouse. This is my note to self, always check for `secure=true` with cloud DBs.
VSCode for Foundry
Setting up VSCode for a new Foundry project. This is my quick reference for getting remappings, the forge formatter, and the solc compiler version right.
Load .env in Rust
My personal log on loading .env files in Rust. I use the envy crate to parse variables into a struct, which makes handling config much easier.
Fix Deserialize in Rust
Fixing the "cannot find derive macro Deserialize" error with serde in Rust. A quick note that the derive feature needs to be enabled in Cargo.toml.
Rust SeaORM Actions
My personal cheat sheet for basic SeaORM operations. It's my reference for how to insert, select, update, and delete a simple row in Rust.
Rust SeaORM Tables
I needed a way to manage database tables in Rust. These are my notes on using sea-orm-cli to set up and run my first migration with SeaORM.
“?” Operator in Rust
A quick note to myself on Rust's `?` operator. It's a cleaner way to handle Result types by propagating errors instead of using a match block.
Size of Solidity Variables
Just a simple note to myself on the size of common Solidity types. A quick reference table for when I'm writing or auditing smart contracts.
Transparent vs UUPS Proxies
A quick reference for Solidity proxy patterns. This is my breakdown of Transparent vs. UUPS, comparing gas overhead and the location of the upgrade logic.
Multichain Testing with Foundry
Figuring out how to test on multiple chains with Foundry. My notes on using vm.createFork to set up different network forks inside my test files.
Get ETH Balance using Ethers.js
My quick reference for fetching an ETH balance using Ethers.js. It's way easier than calling the `eth_getBalance` RPC and converting the hex value.
Shareable TypeScript Configuration
My personal notes on creating a reusable tsconfig for my TypeScript projects. The trick is to publish the base config files as a simple NPM package.