GodwinXbt
I study how protocols fail before I write the code that is supposed to stop them.
I build and ship Solidity systems — payment infrastructure, protocol tooling, on-chain policy enforcement — then audit them the way an attacker would: reading real, deployed source, tracing root causes, proving exploits against forked mainnet state.
Verified findings with working PoCs against live forks. Tools for monitoring invariants and adversarial research. Interests in DeFi, smart contract security, stablecoins, payments, and real-world settlement.
Work
All work- RagnarokAdversarial protocol research infrastructure
A finding is not a finding until valid calls reach an impossible state on a fork.
Security · EVM · Research · TypeScript
- ThemisRuntime invariant monitoring
Most monitors tell you the node is down. The harder failure is the node is up and the state is wrong.
Infrastructure · Distributed systems · EVM
- AgentPayProgrammable payment infrastructureLive
An agent that can spend without an on-chain policy is just a key with a story.
Payments · Agents · Solidity
Selected findings
All research- Criticallemon.fun · Robinhood Chain
LemonCurveFactory legacy bonding curve — total buyer-fund theft
LemonCurveFactory.launch() accepts caller-supplied dexFactory/positionManager addresses with no validation against canonical DEX addresses. ...
Verified with working PoC
- CriticalNoon (USN) · Ethereum
RedeemHandler.redeem() has no USN/collateral ratio check
RedeemHandler.redeem() burns order.usnAmount and pays out order.collateralAmount with no on-chain relationship enforced between the two, for...
Verified with working PoC
- HighFlex Finance · Ethereum
Lender withdrawal shortfall enables free-collateral self-deal
When a Lender (Yearn V3 vault) withdrawal exceeds idle liquidity, TroveManager.redeem() kicks a Dutch auction with receiver set to the withd...
Verified with working PoC
- HighHydrex · Ethereum
MinterUpgradeableV4._initialize() one-time guard is a no-op
_initialize() is meant to run exactly once, guarded by require(_initializer != address(0)). _initializer starts as the deployer's address an...
Verified with working PoC
Expertise
- TypeScript
- JavaScript
- Python
- Solidity
- React
- Next.js
- Node.js
- PostgreSQL
- Ethereum
- Solana
- Vercel
- Docker
- GitHub
Solidity and Foundry for contracts and fork proofs. TypeScript and Next.js for surfaces. viem for reads and traces.