> socials

> AI Agents · Security Research · Blockchain · Exploits

> Co-Founder, Security Researcher @ Consensys Diligence · buidling AI security agents

> gpt-3 'who is tintinweb'

> attack --surface

Smart Contracts · P2P Networks · Protocols · Cryptographic Implementations · Embedded Devices · AI Agents

> whoami

• buidl AI-powered security agents and coding assistants
• improve Security for the Ethereum Ecosystem
• review complex Smart Contract Systems and Off-Chain components
• research new attack vectors and practice Responsible Disclosure
• buidl useful Tools to satisfy the lazy efficiency monk in me
• led InfoSec for a major European corporation
• am on the Ethereum & Ethereum 2.0 Vulnerability Leaderboard
• am #39 in theCyber
• disclosed multiple vulnerabilities in cpp-ethereum, mist, parity, bitcoin-core, and bitcoin miners
• broke parts of Android, OpenSSH, Putty, Python, various Web Applications, and Embedded Devices

> featured

🤖 AI / Agent Ecosystem

• pi-subagents - Claude Code like sub-agents with parallel execution
• pi-gitnexus - GitNexus knowledge graph integration for Pi
• pi-tasks - Claude Code-style task tracking & agent coordination
• pi-schedule-prompt - Pi's Heartbeat - recurring & one-shot agent runs
• claude-code-container - Docker container for Claude Code
• pi-messenger-bridge - Bridge Telegram/WhatsApp/Slack/Discord into Pi
• pi-supervisor - Goal-oriented supervisor for the coding agent
• pi-manage-todo-list - Structured todo list management for Pi
• vscode-chonky - Superhuman LLM Auditing Agent for Solidity
• chonky-task-manager-mcp - Task management with MCP server
• vscode-chonky-remote-pilot - Multi-transport chat bridge for VS Code
• vscode-pi-model-chat-provider - VSCode Language Model Chat Provider for Pi

VSCode Extensions · 1.7M+ installs · marketplace

• vscode-interactive-graphviz - Interactive Graphviz Dot Preview
• vscode-solidity-auditor - Solidity Visual Developer
• vscode-decompiler - Decompile things from VSCode
• vscode-inline-bookmarks - Inline bookmarks
• vscode-solidity-language - Solidity Language & Themes
• vscode-solidity-flattener - Solidity Contract Flattener
• vscode-vyper - Vyper language support
• solgrep - Scriptable semantic grep for Solidity

🔬 Security Research & Tools

• smart-contract-sanctuary - A home for ethereum smart contracts
• solidity-shell - Interactive Solidity shell
• ida-batch_decompile - Decompile All the Things - IDA Pro batch decompiler
• smart-contract-vulndb - Open smart contract audit issue dataset
• ethereum-dasm - EVM bytecode disassembler & static/dynamic analysis
• smart-contract-inspector - The magic X-ray machine for Solidity contracts
• smart-contract-storage-viewer - Storage viewer, datatype guesser & toolbox
• semgrep-rules - Low noise Semgrep security rules
• bugbounty-companion - Bug bounty code-base checker

🥷 Vulnerability Research / Offensive

• pub - Public vulnerability disclosures & PoCs
• ecdsa-private-key-recovery - ECDSA nonce-based key recovery
• scapy-ssl_tls - SSL/TLS layers for Scapy
• electron-inject - Inject JS into Electron apps
• striptls - STARTTLS stripping attack proxy
• aggroArgs - Buffer overflow vulnerability testing

> trophy

OS agnostic, any programming language, any architecture, things will be reverse engineered if needed.

• 🏆 - SSL DROWN attack / Hon. mention
• 🏆 - Ethereum Bug Bounty
• 🏆 - Ethereum 2.0 Bug Bounty
• 🏆 - Research
• 🏆 - npm
• 🏆 - [thedao.fund] Round #1 ETH Security Badge Holder

📋 Public Disclosures — 40+ vulnerabilities across:

• Android — CVE-2017-13208 · RCE via DHCP out-of-bounds write (Android 5.1–8.1)
• OpenSSH — CVE-2016-3115 · CRLF injection to bypass shell-command restrictions
• PuTTY — CVE-2016-2563 · Stack-based buffer overflow RCE via SCP
• Python — CVE-2016-0772 · StartTLS stripping in smtplib
• Ethereum — Mist browser arbitrary command execution, Parity SOP bypass, Trinity & Teku DoS
• Nim — 6 CVEs including arbitrary code execution via package metadata
• IPFS — Path traversal, IPNS downgrading & takeover, CORS bypass
• Bitcoin miners — RCE & directory traversal in cgminer, bfgminer, Claymore

> stats