STEFANY DOS SANTOS / 0xSFTWR

Independent security researcher

SoftwareArchaeology

I investigate protocol logic, broken permissions, and the places where funds or identity cross a boundary. Then I build a reproducible test that makes the impact clear.

Contact Stefany Download résumé Inspect the study

OPEN TO ASYNC SECURITY ROLES + SCOPED REVIEWS

FIG. 01 — SYSTEM STUDY

Understanding how systems work.

Security research, reverse engineering, and careful deconstruction.

Hover to inspect. Click to reconstruct.

System study
ACROSS PROGRAMS25+ PAID FINDINGS HACKENPROOF · 21 OCT 2026TOP 100 / #80 COMPTIASECURITY+ / NETWORK+ WORKING STYLEASYNC / US BASED

01 / EXPERIENCE + QUALIFICATIONS / UPDATED 2026-10-21

Receipts
with teeth.

I'm Stefany, an independent researcher with a background in programming and network security. My work focuses on authorization, protocol accounting, and proving what a vulnerability actually changes.

01RESEARCH OUTCOMES
25+ PAID FINDINGS
Across security programs. Independent research since August 2025.
02EDUCATION
B.A.S. NETWORK SECURITY & FORENSICS
Palm Beach State College. Associate of Science in Programming.
03CERTIFICATIONS
CompTIA SECURITY+ / NETWORK+
Python, Solidity / Foundry, JavaScript, Git and Linux. SQL: 5 years. AWS: working knowledge.

HACKENPROOF RECORD CHECKED 2026-10-21. TOTAL INCLUDES OTHER PROGRAMS.

Download the full résumé ↓

CASE 001 / PUBLIC DISCLOSURE / CRITICAL

DISCLOSED

Bridged funds can become permanently locked.

Overlayer SC DualDefense Audit: an _credit() underflow can revert the hub receive path.

HUB RECEIVE_CREDIT UNDERFLOWFUNDS LOCKED
WITHHELD BY DISCLOSURE POLICY WITHHELD BY DISCLOSURE POLICY WITHHELD BY DISCLOSURE POLICY

02 / FIELDWORK / ATTACK SURFACE INDEX

Hostile
state.

The useful bugs live where individually valid rules stop agreeing with one another.

  1. 01

    Cross-chain accounting

    Credits, debits, settlement, message paths, and finality.

    BRIDGE / OFT / PROOF
  2. 02

    Perps + order flow

    Execution, margin, intent, pricing, and position transitions.

    POSITION / MARGIN / INTENT
  3. 03

    Committed-value recovery

    Queues, refunds, retries, unwind, and value already in flight.

    ESCROW / CLAIM / RECOVERY
  4. 04

    Authority composition

    Allowances, permissions, blocklists, and cross-call identity.

    AUTH / IDENTITY / STATE

03 / EVIDENCE STANDARD / CONTROL BEFORE CLAIM

Mechanics are
not impact.

Every candidate has to survive the same-state control, full-lifecycle economics, and the final recovery state.

  1. 01 / SHARED STATE

    Freeze the moment before the disputed action.

    Same balances. Same claims. Same authority. Same market.

  2. 02 / TRUTHFUL CONTROL

    Run the strongest protocol-valid alternative.

    Not convenient calldata—the best executable recovery or intended path.

  3. 03 / ATTACK PATH

    Execute the full lifecycle.

    Setup, capital, maintenance, gas, helpers, unwind, and recovery.

  4. 04 / INCREMENTAL HARM

    Reconcile what the bug alone changed.

    Victim assets, attacker wealth, debt, claims, reserves, and final state.

04 / PUBLIC ARCHIVE / INSPECTABLE SOURCES

Open
record.

No filler projects. Only public artifacts that can be opened and checked.

SRC_001

HackenProof profile

PRIMARY RECORD

 SRC_002

Web3 Security Research Methodology

PROCESS NOTES

 SRC_003

CosmWasm gas-accounting research

DIAGNOSTIC HARNESS

The methodology and CosmWasm repositories are research artifacts. The CosmWasm report was closed on asset-scope grounds; it is not an additional accepted finding.

WORK WITH STEFANY / TRANSMISSION OPEN

Have something
worth breaking?

I'm open to async security roles, contract research, and focused reviews with a clear scope. Send a repo or system overview, the question you need answered, and your timeline.

01 / REVIEW

Focused security review

Authorization boundaries, smart-contract logic, or a specific value flow. A written scope, reproducible tests, and findings you can act on.

02 / VALIDATE

PoCs + fix verification

Reproduce a reported issue, test its impact, and check the proposed fix with control and regression tests.

03 / COLLABORATE

Research support

Work alongside an audit or engineering team on source review, test harnesses, and clear technical reporting.

sftwrlabs@gmail.com

Florida, US · Async first · Planned overlap 8–11 a.m. Eastern