K.

Available for smart contract security reviews

Kalyan TR finds the bug that ships past the first pass.

Smart contract security researcher. 5+ years across software QA and financial systems, including roles at JP Morgan and Franklin Templeton. Now full-time on EVM, Solana, Stellar, and cross-chain protocols.

HackenProof Sherlock Immunefi Findings repo
21 Validated findings
contests and bounties
1C · 4H · 6M + 10 Low
across contests & bounty programs
5+ Years in QA & financial systems
incl. JP Morgan · Franklin Templeton
3 Ecosystems
EVM · Solana · Stellar

01 — Proof

Validated findings

Every row is confirmed by a platform or protocol team. Duplicate means independently found the same bug as the lead reporter — credit shared, bug real.

Protocol Platform Findings Status
Solv BTC+
BTC yield / restaking
 HackenProof 1 Critical Dup Valid · shared credit Report →
Hyperbridge
ISMP / cross-chain coprocessor
 HackenProof 1 High Dup Valid · shared credit Report →
Quantus
Post-quantum L1 · ZK payments · Substrate / Rust
 Immunefi 1 High —
Firelight
On-chain cover · ERC-4626 vault
 Immunefi 1 High Confirmed · report private —
0xMarkets
On-chain markets
 HackenProof 1 High 4 Medium Paid —
Fluid DEX V2
DEX · first paid contest finding
 Sherlock 1 Medium Report →
Limit Break AMM
AMM · collaborative audit
 Guardian Audits 1 Medium paid Report →
Jupiter Lend
Solana lending
 Code4rena 2 Low Validated Report →
Monetrix
Synthetic / vault
 Code4rena 2 Low Validated Report →
K2
Contest findings
 Code4rena 4 Low Validated —
XRP Ledger
XRPL amendments
 Sherlock 1 Low paid —
Battle Chains
Incentivized testnet
 CodeHawks 1 Low Validated —

Duplicate (Valid) — independently identified the same vulnerability as the lead reporter. Credit is shared.

02 — Services

What you can hire me for

Smart contract review

Manual review, attack-path analysis, accounting and protocol logic.

Invariant & fuzz testing

Stateful fuzzing around protocol safety properties on the native test stack.

Finding validation & PoC

Reproduce a suspected bug and build a concrete exploit test before you ship a fix.

03 — How I work

Falsification-first.
PoC before submission.

  1. Falsification-first

    Kill weak hypotheses before investing in a PoC. Most “bugs” die here. The ones that survive get a test.

  2. Test-before-submit

    Reproduce first. Report second. PoCs use the protocol’s native test stack — Foundry, Anchor, Rust, or TypeScript.

  3. Devil’s filter

    Who benefits. What is the concrete trigger. What is the honest-user harm. If that triangle doesn’t close, it isn’t a finding.

  4. Cross-check

    AI is a suggestion layer. Spec and code are the source of truth. I verify both before I write the report.

  5. Fuzz and invariants

    Fuzz and invariant suites to hit the paths unit tests miss, and to prove the protocol still holds under arbitrary input.

04 — Stack

Security stack

Languages

Solidity · Rust (Anchor / Solana) · Soroban / Stellar

Tooling

Foundry (unit, fuzz, invariant) · Slither · Anchor test harnesses

Ecosystems

EVM · Solana · Stellar

Cross-chain

LayerZero · ISMP / Hyperbridge

05 — Selected projects

Built to audit

Async Settlement RWA Vault

ERC-4626 vault with real T+1 / T+2 settlement for tokenized Treasuries and private credit. Stable NAV, slippage protection, compliance rescind, admin yield injection. Invariant fuzz 1000 × 128 + mainnet USDC forks.

Solidity · Foundry →

Collateralized Debt Solvency Engine

Over-collateralized stablecoin engine with health-factor liquidation, pull-over-push payments, and invariant handlers for solvency.

Solidity · Foundry →

Verifiable RNG Distribution

Gas-optimized lottery with Chainlink VRF v2.5 and binary-search cumulative sum for O(log N) winner selection. Factory + auto-subscription.

Solidity · Foundry →

ModularGarden

ERC-2535 Diamond + ERC-4337 account-abstraction wallet framework. Mentored by Nick Mudge, Blok Capital Cohort #1.

Solidity · ERC-4337

06 — Background

Training and prior work

Rektoff Launchpad × Solana Foundation

Rust Security Bootcamp — Grade A, 216 pts

Capstone: MetaLend audit. 15 findings across admin auth, oracle validation, liquidation math, and flash-loan vectors.

Blok Capital Builder Cohort #1

ERC-2535 Diamond + ERC-4337

Mentored by Nick Mudge. Built ModularGarden, a diamond + account-abstraction wallet framework.

Scaler

Master’s Program in Computer Science

Completed postgraduate-level training in computer science, software development, problem-solving, and system design.

Prior career

QA and financial systems — 5+ years

Roles across software QA and financial systems, including JP Morgan and Franklin Templeton. Order flow, settlement, accounting consistency.

07 — Available

Shipping a protocol? I’m available for smart contract security reviews and audit collaborations.

Also open to associate security researcher roles. Fast to start. Reports come with a reproduction on the protocol’s stack.

Email Kalyan DM on X Findings repo