Panther / Smart contract security
I’m Panther. I review Move systems on Sui and Aptos, plus complex DeFi across Rust, Solidity, and Cairo. From state transitions to solvency, I follow the assumptions that put funds at risk.
move_to(@aave_data, Data)
configuration resource stored
borrow_global<Data>(@aave_pool)
getters point to a different address
ERESOURCE_DNE
core configuration reads abort
// public proof where disclosure allows; precise role labels everywhere
@aave_data, while every getter read @aave_pool. The resulting resource-not-found abort was confirmed High.OwnableTwoStep state lifecycle.Grouped by language and ordered by indexed evidence views — not self-assessed skill. Multi-runtime engagements can appear in more than one stack. Every named codebase links to its evidence; nothing here is an endorsement.
also on recordVelvetstake.link
25 named systems shown · the full record spans 79 distinct engagements and programs, including NDA work open the full work record →
// state transitions over checklist scanning; evidence over intuition
Turn documentation, trust boundaries, privileged roles, and protocol economics into explicit properties the system must preserve.
Follow capabilities, value, oracle data, and cross-module state through the real execution paths—including composed transactions.
Break the model at its boundaries, reduce material issues to reviewable evidence, then verify the fix against the original invariant.
The roster combines commissioned firm-side delivery and public contest platforms; those roles are labelled separately in the work record. The NDA-safe private ledger contains 34 engagements, with client names shown only where disclosure permits.
“The auditor bonus goes to @theblackpantherhere for this one! Great performance by all others as well, thank you!”
“Just wanted to drop a positive feedback, I really like both your skills and dedication. It's great working with you ser.”
“I wanted to thank you for your insanely good work throughout the engagement, you submitted a lot of findings, and each one was of high quality. I would recommend you eyes closed.”
// Private engagement feedback; names and roles are shown only where attribution is permitted. Publicly verifiable work remains linked separately in the ledger.
Explore review scope, relevant findings, and technical writing for your protocol.
Independent Move auditor for Sui, Aptos and Movement. Explore Panther's Aave finding, private review experience, and Move formal verification research.
Explore experience and research →Panther's independent Rust security research: Solana program reviews, Tensor NFT AMM contest findings, and staking protocol audit methodology.
Explore experience and research →Independent Cairo security researcher Panther: OpenZeppelin CVE-2024-45304, Starknet staking contest work, and ownership lifecycle analysis.
Explore experience and research →Independent Solidity security researcher Panther reviews EVM DeFi. Explore Arcade, Venus, Juicebox and Velvet contest experience and lending audit guides.
Explore experience and research →Independent DEX security research by Panther: AMM, order-book and perpetuals review experience across Move and Rust, with protocol audit field guides.
Explore experience and research →Panther reviews DeFi lending and borrowing security: Aave Aptos findings, Sui formal verification, collateral, oracles, liquidations and protocol accounting.
Explore experience and research →Move systems on Sui, Aptos, or Movement, and complex DeFi—especially lending, perps, DEX/CLOB, vault, staking, RWA, oracle, and cross-chain logic. Solana Rust and EVM Solidity scopes are regular work too; other ecosystems are considered when the protocol mechanics match the review depth.
Per scope and complexity. Focused reviews can fit inside a week; comprehensive reviews commonly run one to three weeks. Share a scope summary, estimated LoC, repository or documentation, and target dates for a concrete quote.
Yes. Most firm-side work is under NDA. A mutual NDA can be established before private code access, and public disclosure happens only where the engagement permits it.
Yes. Use the firm-side intake route and include ecosystem, approximate scope, delivery window, expected role, and your internal reporting workflow.
accepting selected review scopes
Send the ecosystem, scope or estimated LoC, repository/docs, target dates, and the outcome you need. Start with a public link or scope summary; private repository access can move to an NDA-backed channel.
// verified channels: X / Twitter: @thepantherplus ↗ · Telegram: @theblackpantherhere ↗