About

I'm a cybersecurity leader who solves big problems at every level of the stack. I disclose critical vulnerabilities in software and smart contracts directly securing billions of dollars and I engage with non-technical leaders and stakeholders by meeting them where they are.

I founded SEAL, a non-profit, to solve cybersecurity challenges the cryptocurrency industry faces on a global scale. Previously, I was a Research Partner at Paradigm.

Writing

Findings

  • ★Rari

    Reentrancy in cEther's use of `.call.value` across Fuse pools allowing theft of all borrowable assets

    Mar 2022
  • ★Etherscan

    Verification bypass allowing mismatched source code to pass contract verification

    Nov 2021
  • ★SushiSwap MISO

    `BoringBatchable` delegatecall preserved `msg.value` across batched `commitEth` calls, allowing reused ETH to drain ~$350M via refunds

    Aug 2021
  • ★ENS Name Wrapper

    ERC-1155 safe transfer callback enabled reentrancy during minting

    Aug 2021
  • ★go-ethereum

    Bug in fast sync state downloader could be exploited to booby-trap the blockchain and trigger a hard fork

    May 2021
  • ★Ambisafe

    Four-year-old state corruption bug in contracts managing over a billion dollars in assets

    Apr 2021
  • ★Optimism

    `relayMessage` could be called on the L2-to-L1 Message Passer, enabling call spoofing on L2

    Feb 2021
  • ★Lien Finance

    Anyone could mint tokens for free, then burn them for all 25,000 ETH ($9.6M) in the contract

    Sep 2020
  • ★Authereum

    Order-of-operations flaw in meta transaction function allowed account takeover

    Feb 2020
  • ★Ethereum Name Service (CVE-2020-5232)

    Domain owner could set a backdoor to claw back ownership after transfer

    Jan 2020
  • ★Pillow (CVE-2019-19911)

    Unvalidated integers in FpxImagePlugin.py caused memory exhaustion

    Dec 2019
  • ★Kyber Network

    Reentrancy in bridge reserve trade process allowed draining of Kyber-operated reserves

    Sep 2019
  • ★bZx Network

    Oracle vulnerable to price manipulation through permissioned Kyber reserves

    Jul 2019
  • ★0x Exchange

    Signature verification treated `0x04` as valid for all non-contract accounts, allowing forged order fills

    Jul 2019
  • ★mathjs

    Multiple methods to escape the sandboxed expression parser and achieve RCE

    Apr 2017

Talks

Press

Contact

sam@samczsun.com@samczsunsamczsun@samczsun@samczsunsamczsunsamczsun.eth