Proven background and public proof

I came into smart contract security through the Bulgarian auditing scene and the Pashov Discord, back when it was Bulgarians-only (there is an English side now). I read a pile of manual audit reports to learn what good looks like, but the real teacher was doing the work. Auditing contests, and then judging them on Sherlock, is what sharpened how I reason about severity. Sitting on the judging side, deciding which findings actually hold up and which fall apart under scrutiny, teaches you more than any writeup can.

For a while I was active in OpenSense, one of the larger Web3 communities at the time, with a weekly AMA with a top auditor and usually some real alpha to pick up. It also ran competitive auditing teams. I audited as part of one of them, Black Panda, led by Deliriusz, a deeply low-level engineer who pushed me toward the assembly and EVM-internals end of the craft, where a lot of the subtle bugs actually live.

These days I do both sides of the work. I audit smart contracts, and I build dApps from scratch. The two feed each other. Reviewing other people's code for a living means I build with exploit paths already in mind, and shipping production contracts and frontends means my audits come from someone who has actually built the thing being reviewed, not just read about it.