ustas@mcmurdo:~/about
$ whoami
ustas — security researcher & web3 developer
location: lviv, ua → buenos aires, ar
languages: en, uk, ru, es
focus: vulnerability research, security tooling, smart contract auditing
vibes: pro-FOSS, pro-privacy, 60–80s rock
$

The road so far

2017–2021

The rabbit hole

Started farming airdrops with Google Forms and running nodes before most people had a MetaMask. In parallel, taught myself to break things — reverse engineering, web exploitation, deobfuscating JS and Android apps, scraping at scale. Two rabbit holes, one curious kid.

2021–2023

College dropout → smart contract dev

Three-quarters through technical college, Ewin Games offered me a junior dev spot building smart contract systems for their blockchain games on EVM. Didn't think twice. Turns out shipping code you can't patch teaches you a lot about security.

2023–2025

Going pro

Joined Hexens as a security researcher and spent a year auditing tier-1 protocols — 10+ highs, 20+ mediums. Competed on Code4rena, Cantina, and Sherlock. Did the zkEVM and Solana bootcamps. Placed top 2 in Wonderland CTF, solved challenges in BlazCTF and zkHack, and wrote one for Remedy CTF that got 1300+ submissions.

present

Now

Independent researcher specializing in DeFi, cross-chain systems, and L1/L2 infra — combining on-chain data analysis with manual code review across EVM and Solana. Also building an LLM-powered autonomous bug hunter that doesn't care what language your code is in.

Tools of the trade

Solidity Rust Python JS EVM Solana Yul Foundry Anchor Halmos Dune SQL Fuzzing LLM tooling Claude Code Codex CLI

Platforms

Code4rena · Cantina · Sherlock