$ whoami

Solana security researcher — Rust, Anchor, and Pinocchio internals.

$ ls writeups/ | head -3

view all →

$ ls engineering/

VerifiBet

A Solana parimutuel prediction market for the 2026 World Cup, settled against TxODDS's on-chain TxLINE data feed instead of a trusted oracle — resolve_market can't mark a market resolved without a real Merkle-proof CPI into TxLINE succeeding first, and every settlement receipt ships a client-side "verify in your browser" button that recomputes the same proof. Payouts are parimutuel (stake × total_pool ÷ winning_pool, no house edge) into escrow that's the canonical token account of each market's own PDA, so there's no admin sweep path. Live on devnet, with keeper logic that runs the lock → resolve → void cycle end-to-end.

[Rust][Anchor][Solana][Next.js][TypeScript]

Staking Vault

An Anchor-based SPL staking vault on Solana, with a TypeScript SDK and web app, built around one invariant enforced at every instruction boundary: vault.amount == pool.total_staked == Σ stake.amount. The security suite covers 9 adversarial threats — double-claim, fake vault substitution, pool re-initialization, rounding theft, and others — validated across 48 LiteSVM integration tests plus 10 Rust unit tests. Also includes a second, independent implementation of the same protocol subset written natively against Pinocchio — no_std, zero-copy, no external dependencies — to prove the protocol logic isn't tied to Anchor. Live on devnet.

[Rust][Anchor][Pinocchio][Solana][TypeScript]

Price Impact on Solana: Order Book vs. AMM

A short empirical research note comparing price impact on Solana's SOL/USDC market across an order book (Phoenix) and an AMM (Raydium), isolated via Jupiter's quote API across five trade sizes from $100 to $100,000. Finds Phoenix's impact is stepwise and accelerates sharply past its resting top-of-book depth, while Raydium's constant-product curve grows smoothly and near-linearly — with Raydium quoting tighter execution at every size tested in this snapshot. Includes the raw data, fetch script, and a SHA-256 timestamp of the writeup anchored via a Solana devnet memo transaction.

[TypeScript][Solana][Jupiter API]