Skip to content
View myhubstat's full-sized avatar
7 followers · 15 following

Achievements

Achievement: Pair Extraordinairex2Achievement: Pull Sharkx2Achievement: Quickdraw

Achievements

Achievement: Pair Extraordinairex2Achievement: Pull Sharkx2Achievement: Quickdraw

Block or report myhubstat

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
myhubstat/README.md

(@myhubstat) — Smart Contract & Protocol Security Researcher

Portfolio & Audits EVM Static Analyzer

Independent smart contract and protocol security researcher specializing in EVM / Solidity DeFi protocols (ERC-20, ERC-223, ERC-4626, EIP-7702, lending routers, concentrated liquidity AMMs, and share-accounting invariants), Rust L1/L2 wallet & confidential transfer security, and compiler/static-analysis soundness.

  • Security Portfolio & Public Disclosures: github.com/myhubstat/audits
  • Audit Methodology: Manual architectural & state-transition review backed by stateful Foundry (forge test) PoCs, boundary rounding/interest math verification, and custom static analyzers.

Featured Security Research & Public Disclosures

Target Protocol Disclosure / PR Vulnerability Class & Impact Status
EthereumCommonwealth/Dex223-contracts (DEX223 AMM Core & Periphery) Audit #36 · Fix PR #138 Dex223QuoteLib.quoteSwap exact-output return inversion, Dex223Pool.quoteSwap Error(string) ABI-decode corruption, ProtocolFeeCollector 300k gas OOG on ERC-223 conversion, and swapExactInput negative amountSpecified guard. Public Audit + Upstream Fix PR
EthereumCommonwealth/Dex223-contracts (DEX223 Exchange & Listing Registry) Issue #25 · Issue #26 EIP-7702 (0xef0100) delegated EOA callback bypass in ERC223 transfer flow and duplicate fee-token tier overwrite in AutoListingsRegistry. Public Disclosure + Foundry PoC
tari-project/tari-ootle (Tari L2 Confidential Wallet & Daemon) PR #3135 · PR #3158 · PR #3157 · PR #3155 Fixed live network broadcast during --dry-run confidential transfers (MERGED), hardened walletd value_summaries against amount_leaving: 0 approval-card spoofing (#3150), and fixed SQLite cross-account output lock overwrite (#3156). MERGED / Active Upstream PRs
limitlessprojects/Go-Hybrid (Rust / Go Ownership & Borrow Verifier) PR #1998 · PR #1918 · PR #1897 · PR #1809 Fixed soundness bypasses in any-field composite share tracking (HYB-E3004), closure alias A3 loan windows (HYB-E3102), managed-block audit metadata injection (HYB-E0003), and truncated constant-key collisions. bot:land-candidate (9/9 Pareto)
SlopDotCash/slopdotcash (Solana Token-2022 & Governance) PR #1435 · PR #1348 Preserved verified Solana Token-2022 program ID across browser vault initialization (MERGED) and enforced reviewer independence on appeal denials. MERGED Upstream

Security Tooling & Open-Source Repositories

  • myhubstat/audits — Public smart contract & protocol security disclosures, Foundry PoC harnesses, and remediation diffs.
  • myhubstat/evm-bounty-guard — Static security analyzer for EVM/Solidity smart contracts (ERC-20, ERC-223, CREATE2, reentrancy, and unchecked low-level call detectors).
Verified Settlement & On-Chain Identity
  • Primary EVM (Base / Ethereum / Arbitrum / Optimism / Polygon — USDC / USDT / ETH): 0x669fBa588D75577610459a2577eabdbbBa080e4A
  • Backup Tron (TRC-20 — USDT-TRC20 / TRX): TMbSRkXiuURMnMAvHp6p7Fpr5BrzU3YMDB

Popular repositories Loading

  1. Go-Hybrid Go-Hybrid Public

    Forked from limitlessprojects/Go-Hybrid

    Hybrid: a Go superset with compiler-enforced ownership & sendability. Add a .hy file, get plain readable Go. If you know Go, you already know Hybrid.

    Rust

  2. myhubstat myhubstat Public

    Smart Contract & Protocol Security Researcher — EVM (Solidity / Foundry), Rust L1/L2 & Compiler Soundness

  3. evm-bounty-guard evm-bounty-guard Public

    Static security analyzer for EVM/Solidity smart contracts (ERC-20, ERC-223, CREATE2, reentrancy, and unchecked low-level call detectors)

    Python

  4. agent-pay-router agent-pay-router Public

    Multi-chain crypto settlement & address checksum verifier for Base/EVM (EIP-55 USDC/USDT) and Tron (TRC-20 Base58Check SHA-256) payout rails

    Python

  5. oss-bounty-radar oss-bounty-radar Public

    Real-time GitHub & on-chain escrow bounty scanner that filters out symbolic/unfunded repos by verifying live maintainer merge velocity and USDC escrow balances

    Python

  6. slopdotcash slopdotcash Public

    Forked from SlopDotCash/slopdotcash

    Full-stack TypeScript & Solana Token-2022 vault utilities

    TypeScript