Sanitized case studies — names redacted under NDA, outcomes real. Full reports delivered as PDF + Notion + Loom.
After two prior audits, we found tx.origin vs msg.sender guard bypass → vault drain in Foundry invariant test. PoC: exploit.t.sol + Loom. Patch: CEI + nonReentrant. Re-test in 48h, shipped with fuzz corpus in CI. 87.4% coverage, 1.2M cases.
parse_header lacked bounds check on hdr->len → heap overflow, adjacent chunk overwrite → ROP chain demo. PoC: poc_obs001.py + poc_obs001.mp4. Patch: explicit bounds + unit test. Client quote: "The best binary report we've received."