Ξ
EVM
Solidity reentrancy, delegatecall, oracle and bridge logic.
Available for security engagements
Gul Hameed
[ ▌ ]
I break things before attackers do. A senior security engineer working across the full offensive stack: web, mobile and API penetration testing, centralized exchange assessments, and deep smart contract audits across 9+ blockchain ecosystems.
➜ ~ whoami
gul_hameed // senior security engineer
➜ ~ cat profile.json
{
"role": "Security Engineer",
"at": ["BlockApex", "Hacken"],
"covers": ["web", "mobile", "api", "web3"],
"ecosystems": 9
}
➜ ~ ./scan --target protocol▌
0
Blockchain ecosystems
0
Smart contract languages
0
Offensive security certs
01
Who's behind the keyboard
I'm Gul Hameed, a senior security engineer who lives where Web2 application security meets Web3 protocol auditing. My job is easy to say and hard to do: find the bug that drains the vault, or owns the server, before someone else does.
My work isn't only on-chain. I run full web, mobile and API security assessments, and with Hacken I've audited the platforms behind centralized exchanges: web apps, APIs and the infrastructure around them.
On-chain, I research Web3 security at BlockApex and audit dApps at Hacken. I've shipped audits for bridges, perpetuals, AMMs, lending markets, stablecoins, liquid staking tokens, oracles, launchpads and full appchain architectures, with a handful of valid findings on Cantina and HackenProof. On top of that I build the tooling that makes audits faster, I write, and I speak.
02
Ecosystems I hunt in
Nine chains, nine threat models. Each one has its own VM and its own footguns.
◎
Solana
Account validation, PDAs, CPIs, perps and launchpads.
⌬
Cosmos
CosmWasm, appchains, IBC and module level invariants.
◈
TON
Func and Tact actors, async messages, pool staking.
Ⓝ
NEAR
Rust contracts, gas and cross contract callbacks.
∞
ICP
Motoko and Rust canisters, inter-canister and cycles safety.
◬
Aptos
Move resources, the ability model and formal specs.
⛽
Fuel
Sway and the FuelVM, UTXO model and predicate logic.
⬡
Canton
DAML privacy model, sub transaction structure and rights.
// Languages
Solidity
Rust
Move
Motoko
Tact
Func
Sway
Go
DAML
// Coverage & domains
Web app pentest
Mobile
API security
CEX platforms
Bridges
Perpetuals
AMMs
Lending
Stablecoins
Liquid staking
Oracles
Launchpads
Appchains
03
Selected audit work
Smart contract and protocol audits across the stack. Tap a card to open the report.
EVM
DeFi · staking
ADOT Finance
DeFi protocol audit covering staking flows, reward distribution and access control across the contract suite.
View report ↗
Cosmos
Appchain + contracts
Axone
Audited the Axone appchain and its CosmWasm contracts: module invariants, message handling and Data Hub logic.
View report ↗
Neutron
Launchpad · staking
Eclipse Fi
Launchpad staking v2 and vesting contracts on Neutron: reward math, lockups and vesting schedule integrity.
View report ↗
Web3
Smart contracts
Gemz
Smart contract audit of the Gemz protocol, reviewing token mechanics, core logic and access control.
View report ↗
ICP
Liquid staking
Meta Pool
Liquid staking audit (stICP) on the Internet Computer, part of Meta Pool's multichain LST suite.
View report ↗
EVM L1
Account abstraction
Nero Chain
An EVM compatible L1 with native account abstraction. Reviewed core chain contracts and the AA paymaster flows.
View report ↗
Aurora
Marketplace + threat model
Ember
EARN marketplace and ENS audits on Aurora, plus a full protocol threat model mapping the attack surface.
View report ↗30+ audits delivered
These seven are highlights. See the full portfolio of 31 protocol audits on my GitHub.
View all on GitHub ↗Web2 & exchange security
Not everything lives on-chain. With Hacken I've assessed six centralized exchange platforms across web, API and mobile.
KCEX
View report ↗
MEXC
Hacken engagement
CoinEx
Hacken engagement
MAICOIN
Hacken engagement
1money
Hacken engagement
J-CAM
Hacken engagement
20+ web2 projects
View all on GitHub ↗
04
Open source & tooling
Security tools and learning resources I build and maintain.
drozer-lite
★ 4
Fast, deterministic Solidity pattern scanner derived from empirical audit gap analysis. An AI assisted smart contract vulnerability scanner.
Canton-daml-auditor-bootcamp
★ 10
A learning track for auditing Canton and DAML: the privacy model, sub transaction rights and the common pitfalls.
backend-security-review
Static security review skill for NestJS / Node backends (MongoDB, web3). A Claude Code CI gate built on OWASP ASVS and the API Security Top 10.
mobile-security-review
Static security review skill for React Native / Expo apps. A Claude Code CI gate built on OWASP MASVS.
05
Writing & research
Methodology, deep dives and post-mortems from the front line.
- Guide How to audit a dApp, end to end
- ICP Securing ICP canisters: best practices and pitfalls
- Deep dive Inside the Fuel VM, from a security lens
- Post-mortem 14+ DeFi exploit breakdowns, from Euler to SushiSwap
- Research Web2 vulnerabilities in Web3 (hackathon winning)
06
Let's secure
Let's secure
something.
Auditing a protocol, hardening an exchange, threat-modeling a launch, or just want a second pair of adversarial eyes? My inbox is open.
Type help and hit enter. (try: whoami, skills, work, cex, contact)
➜ ~
▌