Independent security research
for crypto protocols.
By the founder of AWARE. Three engagement models: a single-finding commitment, a monthly retainer, or a revenue-share bounty partnership. No retainer with any protocol we audit.
Pick the one that matches the question.
All three deliver the same artefact: a working PoC, a disclosure-grade report, and the submission package ready for the bug bounty program or your security inbox.
You name a specific vulnerability, protocol surface, or audit hypothesis. We investigate, build a PoC, and ship the report.
- ✓ Bounded scope (one CVE, one component, one hypothesis)
- ✓ Foundry mainnet-fork PoC + reproducer
- ✓ Disclosure-grade report (CVSS, vector, impact, mitigation)
- ✓ Submission package ready for Immunefi / HackerOne / Code4rena
- ✓ Private disclosure timeline (no public write-up without consent)
Continuous monitoring of one named protocol or contract suite. Weekly digest, one deep-review call per month, ad-hoc questions on your schedule.
- ✓ 1 named protocol, 1 named contact
- ✓ Weekly digest (commits, governance, oracle changes, dependency drift)
- ✓ 1 monthly 60-min review call
- ✓ Pre-release review on tagged upgrades
- ✓ Slack/email async, 24h response
- ✓ Pause or switch protocols with 7-day notice
We research and write the report together. You take the lead on the public disclosure if you want it; we split the bounty under the partner / affiliate program of the protocol in question.
- ✓ You choose the target list (1–N programs)
- ✓ 60/40 or 70/30 split negotiated per finding
- ✓ Disclosure run by you (or jointly, your call)
- ✓ Bounty paid per the program's published schedule
- ✓ N/A for undisclosed bounties (transparent on-chain split)
Spark ALM rate-limit bypass in the controller swap path.
A worked example of a Single-Finding Commitment, ready for the Spark bug bounty on Immunefi.
Two relayer-callable USDS↔DAI swap functions in the Spark ALM controller do not consume the protocol's rate limit.
Every other relayer-callable function in the controller (PSM, Curve, Aave, UniswapV4, LayerZero, OTC) consumes a rate limit. The two swap functions do not. The rate limit is the protocol's primary defense against a compromised relayer, and the removal is deliberate rather than accidental, confirmed against the deployed contract source.
Practical impact is state corruption and composition violation. Outbound asset transfers remain rate-limited, so a direct drain would require a further misbehaviour in the underlying asset. The finding is a deviation from the protocol's own documented threat model rather than a direct fund-loss path, which is why it is scored Medium.
The affected function names, call sequence and source revision are deliberately not published here: the finding is live and the protocol has not completed its disclosure process. The full disclosure package is available under NDA.
Alvin Chang. Founder of AWARE / Good CISO.
Independent
No retainer, equity, or advisory seat with any protocol we audit. Conflict-of-interest review on every engagement. Written disclosure on request.
Deep protocol experience
Built AWARE, the AI-native compliance platform for FCA-regulated firms. Read 200+ Solidity repos, formal-verification reports, and audit write-ups in the last 18 months.
Reproducible
Every finding ships with a Foundry mainnet-fork PoC. No "trust me, the math works out." If the PoC doesn't run, the finding doesn't ship.
Case studies and live findings
A live case study on this page, plus further findings in pipeline. Disclosure packages available on request.
Common questions.
No. I don't compete with firms like Trail of Bits, Spearbit, Cantina, or ChainSecurity on full-scope audits. The engagement model here is targeted: a single named vulnerability, a single hypothesis, or a single named protocol on retainer. If you want a 6-week full audit, I can refer you.
5–10 working days from kickoff to PoC + draft disclosure. Some findings (especially when the hypothesis needs tooling or mainnet-fork setup) run to 3 weeks. We negotiate a hard deadline in the SOW and ship a partial report if we miss it.
No. Single-Finding Commitments are paid regardless of whether the finding is submitted to a public bounty. The deliverable is yours. If you want us to co-submit and split the bounty, that's the Bounty Partnership tier (different engagement).
Anything Good CISO Limited has a commercial relationship with (current AWARE customers, paid pilots, integration partners). Listed on the AWARE website and updated within 48h of any new relationship. If in doubt, ask.
Yes. Mutual NDA, no non-solicit, no IP assignment on the research output. Standard template available on request. NDAs typically add 1–2 days to engagement kickoff.
Pick the engagement. Or just book a 30-min call to scope it.
48-hour triage SLA on every inquiry. No retainer required to start a conversation.