Resume · Lucas / Notes

Personal Information

Master’s Degree | Xi’an Jiaotong-Liverpool University | Sep 2021 - Apr 2023

Major: Financial Computing
Bachelor’s Degree | Nanjing University of Finance & Economics | Sep 2015 - Jun 2019

Major: Mathematics and Applied Mathematics

As a full-time employee, owned test development and security testing for all Solidity modules of Bondify (bondify.xyz).
Bondify is an RWA Loop + Sell YT project with proprietary-fund Loop modules and Loop modules built on Aave/Morpho; handled testing from solution review and development integration through launch verification.
Designed normal, abnormal, boundary, and attack scenarios around fund flows, state transitions, and key invariants, with emphasis on Owner/Admin/Role permissions, upgrades, pausing, parameter changes, external calls, allowance limits, repeated execution, and failed transaction paths.
Provided frontend and operations teams with contract interfaces, yield/accrual formulas, precision and boundary-condition guidance; supported wallet signatures, transaction states, events, RPC, deployment, and network configuration, and diagnosed production issues using transaction hashes, events, and contract state.

Team profile: WatchPug is a small audit team that reached second place on the all-time Code4rena leaderboard.

As a core audit member, participated in approximately 100 DeFi/Web3 smart contract security audit and testing projects; regularly participated in public Code4rena and Sherlock audit contests from Dec 2021 to Jun 2023.
Led or contributed to audits of capital-intensive DEX, yield, lending, and perpetual protocols, covering Uniswap V2/V3/V4, Aave, and GMX forks; designed test scenarios from fund flows, state machines, and permission boundaries.
Focused on reentrancy, privilege escalation, price manipulation, liquidation, precision/rounding, duplicate claims, signature replay, and external-call risks, writing PoCs with Solidity/TypeScript, ethers.js, Foundry/Hardhat, Tenderly, and mainnet forks.
Used RPC, events, transaction hashes, and contract state to diagnose issues, produce risk reports and remediation advice, and verify fixes; provided ongoing monthly retainer security reviews and focused audits for Pendle, Arrakis, Treehouse, Orange (InsureDAO), and Gelato.

Identified the aWETH/WETH discount opportunity on Arbitrum after the Kelp incident; analyzed Aave redemption liquidity, pool depth, and failure conditions, then designed and executed a flash-loan arbitrage route.
Validated the trade with mainnet forks and RPC before deploying it live, achieving 0.5292 WETH net profit on one transaction and 1.5859 WETH in cumulative realized profit across multiple on-chain arbitrage trades. See the technical write-up and Arbiscan transaction.

Implemented a VWAP-based automated trading strategy with order placement, take-profit, risk controls, retry handling, and position recovery.

Integrated staking and yield strategies into the Sandclock multichain ecosystem; implemented principal/yield splitting, strategy comparison, compounding, and yield calculations in Solidity, and verified precision and settlement logic.

Languages & Tools: Solidity, TypeScript, Python; ethers.js, Foundry, Hardhat, and Tenderly; familiar with EVMs, wallet signatures, transactions/Gas/Nonce, RPC, events, and Approve/Allowance.
Security Testing: Reentrancy, privilege escalation, replay attacks, front-running/MEV, approvals, precision boundaries, repeated execution, timestamp/block dependencies, DoS/Gas, malicious external contracts, pausing, and proxy upgrade security.
Delivery: Design test cases from economic models, fund flows, and state machines; reproduce, localize, and verify fixes with mainnet forks and on-chain evidence; use tools such as Codex to assist code analysis and test-script development.

Background in mathematics, finance, and programming, with years of DeFi contract auditing, testing, and security analysis experience; particularly strong in economic models, mathematical reasoning, fund flows, and permission boundaries.
Able to independently complete code review, test design, PoC reproduction, risk communication, remediation regression testing, and launch acceptance, using on-chain data to clearly localize issues.