Skip to content
View ChargingFoxSec's full-sized avatar
0 followers · 1 following

Block or report ChargingFoxSec

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
ChargingFoxSec/README.md

ChargingFoxSec

Web3 security researcher and open-source engineer working across EVM, Solana, and developer tooling.

I turn protocol and tooling issues into reproducible engineering evidence: runnable PoCs, regression tests, and focused upstream fixes. My work covers EVM security review, Solana and Anchor development, and static-analysis infrastructure.

Open to Web3 security engineering, protocol engineering, and developer tooling roles.

Current Focus

  • EVM protocol and smart contract security review
  • Solana and Anchor program development and security research
  • Static analysis, fuzzing, and developer tooling
  • PoC-backed vulnerability labs and audit methodology notes
  • Open-source issue reproduction, regression testing, and upstream fixes

Featured Work

Web3 Vulnerability Labs

Public collection of 20+ PoC-backed labs covering Web3 vulnerability patterns across EVM and Soroban-oriented Rust state-machine models.

The cases preserve non-trivial reasoning patterns encountered during real audit practice while rewriting the implementation as standalone, sanitized examples. Each lab documents the vulnerable flow, exploit reasoning, mitigation, and triage boundaries.

Web3 Vulnerability Labs Tests

  • 90+ automated tests across Foundry and Cargo
  • Vulnerable and fixed implementations with runnable PoCs
  • EVM protocol accounting, authorization, oracle, lifecycle, and callback edge cases
  • Soroban-oriented Rust state-machine models for deferred execution and configuration drift

Repository: web3-vulnerability-labs

Selected Security Results

  • HackenProof - Paid findings across Critical, High, and Medium severities.
  • Sherlock - A validated Medium-severity finding.

Selected Open Source Contributions

  • crytic/medusa#840 - Kept Slither diagnostics separate from machine-readable JSON output and added regression coverage. Merged.
  • anza-xyz/kit#1748 - Prevented JavaScript protocol hooks from being dispatched as RPC methods and added Node and browser regression coverage. Merged.
  • anza-xyz/kit#1741 - Fixed v0 message preamble accounting in off-chain message size validation. Merged.

Aster Payroll

Hackathon prototype exploring privacy-preserving payroll settlement on Solana.

It combines an Anchor onchain program, Token-2022 confidential-transfer concepts, a Laravel operator UI, local verification flows, and payroll receipt import logic. The project is a demo and research prototype, not a production custody protocol.

Repository: aster-payroll

Skills

  • EVM: Solidity, Foundry, Slither, fuzzing and invariant testing
  • Solana: Rust, Anchor program development, SPL Token and Token-2022 concepts, account validation patterns
  • Security: protocol accounting, authorization boundaries, oracle and lifecycle failure modes, exploit reproduction, impact triage
  • Engineering: Go, TypeScript, PHP/Laravel, Python, Git, Docker, GitHub Actions, test-driven debugging

Profiles

Pinned Loading

  1. aster-payroll aster-payroll Public

    Hackathon demo for privacy-preserving payroll settlement on Solana using Anchor, Token-2022 concepts, and a Laravel operator UI.

    PHP

  2. web3-vulnerability-labs web3-vulnerability-labs Public

    PoC-backed toy labs for Web3 vulnerability patterns, exploit reasoning, and audit triage notes.

    Solidity