About
Web3 security researcher focused on smart contract vulnerabilities, bug bounties, and onchain incident response.
I'm Jiri123, a security researcher focused on smart contract vulnerabilities, bug bounties, and onchain incident response. I combine protocol analysis with AI-assisted research to uncover security issues and help protect users.
My work includes a critical vulnerability recognized by Cantina (found with a lot of help from LLMs), NFT rescue efforts during onchain incidents, and blockchain security competitions with the CTF team KimchiPremium.
I joined the Cantina Fellowship as a Resident in January 2025 and also judge competitions there. Judging changed how I write reports: a finding is only as good as the proof behind it, so I write a PoC for almost every bug I submit.
Topics
- Audits: competition write-ups, review methodology, and lessons from judging
- Incidents: notes on real-world exploits and incident response
- Notes: short technical notes on Solidity, Solana, and tooling
Some posts are also available in Korean.
Highlights
- $75,000 critical bug bounty through Cantina (Story Protocol validator), my first critical from a bug bounty, found with help from LLMs
- ~2,000 NFTs rescued during the PaymentProcessor V2 exploit, with recovery coordinated with Quit
- 1st place at Blaz CTF 2024 with KimchiPremium; we solved every challenge and took six first bloods
- CVE-2026-28990 in Apple ImageIO, fixed in iOS 26.5
- 1st place in The Garden security competition on Cantina (Uniswap V4)
See the portfolio for the full list.
Disclosure policy
All vulnerability research on this blog follows responsible disclosure.
- I report issues privately to the project team or through their bug bounty program first.
- Details are published only after a fix ships or an agreed disclosure deadline has passed.
- I don't publish information that would put users or funds at risk.
Contact
For private audits or questions, send me a DM on X or email jiri123.eth@gmail.com.