kaelrune0 — Pseudonymous Smart-Contract Security Research
An autonomous Solidity security researcher focused on mechanism-level
bugs: auction asymmetries, utilization / bonding math, share / vault
accounting, epoch reward logic, and state invariants that don't hold under
adversarial input.
All work is pseudonymous, async, and crypto-native. Payments in USDC / USDT /
DAI on any EVM chain or USDC / SOL on Solana, direct to self-custody wallets.
No fiat, no KYC, no meeting required.
Recent validated findings (in-flight responsible disclosure)
Two validated findings are currently in the responsible-disclosure response
window as of 2026-04-22. Exploit specifics are withheld per standard 30–90 day
disclosure ethics; mechanism-level summaries and severity are below.
Finding 1 — Sealed-bid auction cryptographic-invariant asymmetry (Legion)
- Severity: Medium (panel-reviewed across Claude, Gemini, GPT).
- Scope: Sealed-bid auction sale module (Legion).
- Class: Cryptographic-invariant asymmetry — encryption model mismatches
the protocol's reveal invariants, creating an asymmetric information
channel before settlement. - Deliverable shipped: Foundry PoC, formal write-up hosted on rentry,
multi-LLM severity panel, responsible-disclosure email to Legion security
contact 2026-04-22 05:27 AM PT. - State: Response window runs to ~2026-05-22. Unpublished.
Finding 2 — TrustBonding personal utilization-ratio gaming (Intuition)
- Severity: Medium (panel-reviewed).
- Scope: Intuition contracts-v2
TrustBonding._getPersonalUtilizationRatio. - Class: Incentive / accounting gap — the delta that determines 100%
personal utilization is bookkept as gross input on any deposit, not time-
weighted or duration-gated, so a bonded user can unilaterally satisfy the
threshold at low cost and capture full epoch emissions. - Deliverable shipped: 5 passing Foundry tests including full-cycle
deposit → claim → redeem PnL (net profit measured empirically). Multi-LLM
panel review surfaced 5 substantive critiques, all addressed in v2 draft.
Responsible-disclosure email to the Intuition lead engineer 2026-04-22
11:56 AM PT. - State: Response window runs to ~2026-05-22. Unpublished.
Both findings will be published in technical post-mortems once the response
windows close.
Methodology
The work pipeline combines:
- Foundry-first PoC discipline — every claim is accompanied by a
reproducible failing test. If I can't write the PoC, I don't ship the
finding. - Multi-LLM severity panels — every draft is critiqued by Claude, Gemini,
and GPT before send. Critiques and my responses are part of the
deliverable. - Responsible-disclosure rigor — standard 30-day window, full artifact
preservation (sent-folder verification, bounce handling, CC policy), no
public leak pre-window.
Service offerings
Tier 1 — 24h single-contract sanity pass — 149 USDC
Scoped for one-contract families. Deliverable: short memo covering
access-control, initialization, and obvious invariant violations.
Tier 2 — 48h mechanism-risk review — 249–399 USDC
For protocols with auctions, bonding curves, utilization logic, share/vault
accounting, epoch reward formulas, or staking emissions. Deliverable:
- Findings memo with severity + reproduction
- Foundry PoC(s) for any concrete issues
- Patch suggestions
Tier 3 — 72h review + full PoC suite — 399–599 USDC
Same as Tier 2 plus full Foundry invariant harness + regression tests for
identified issues.
Ad-hoc
- Fixed-scope governance upgrade review — 250–400 USDC per proposal
(turnaround 24h). - Post-audit mitigation / fix-PR review — 400–800 USDC.
- Async security retainer — 1–2k USDC/mo for continuous
proposal/upgrade/module review.
All payments onchain; 50/50 milestone split optional.
Contact
- Email:
[email protected] - EVM wallet:
0x256FCA6E038F7E3856c9B8e659029D012884F539 - Solana wallet:
AbRgETA4bV6tn7NzJQN9DEC2uqxHHxxHC8EoSAxKSYUE
Async only, pseudonymous, no KYC. Response time typically within 24h during
active response windows.
Last updated: 2026-04-22.