field notes
Write-ups and research notes. Targets are named only after a fix ships or an advisory is public.
Static analysis found 321 panic sites in a BFT consensus engine. Most are unreachable noise. This is the process that separated one provable, network-triggered crash from the rest, including the two attempts that honestly failed.
A consensus-signing service exposed an unauthenticated gRPC endpoint that would sign arbitrary bytes without message semantics or double-sign protection. Reproducing it required building the exact 75-byte canonical vote encoding from the project's own codec before anything could be proven.