Skip to content
View floflo777's full-sized avatar
11 followers · 9 following

Achievements

Achievement: Pull Sharkx3Achievement: Pair Extraordinairex4Achievement: StarstruckAchievement: QuickdrawAchievement: YOLO

Achievements

Achievement: Pull Sharkx3Achievement: Pair Extraordinairex4Achievement: StarstruckAchievement: QuickdrawAchievement: YOLO

Block or report floflo777

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
floflo777/README.md

0xFlorent

Security researcher and DeFi / ZK builder. I recover funds stuck in old contracts, solve on-chain puzzles, hunt protocol bugs, and build privacy-preserving DeFi on Aleo.

Most of what I do starts from a self-hosted Ethereum node and a lot of reading old Solidity by hand.

White-hat recoveries

  • ~1,003 ETH unlocked from the failed 2016 HongCoin ICO, frozen for 9 years. I found the path (an unchecked overflow in the team's own admin function), proved it on a Foundry mainnet fork, and disclosed it to the original team, who executed it on-chain. No funds taken, no fee. See hongcoin-recovery.
  • ~19.3 ETH returned in earlier cases: a dormant 2018 ICO refund (5.1 ETH) and 7 expired Liquality HTLCs (14.2 ETH).

On-chain puzzles

  • 4 Bitcoin key puzzles solved from Kary Finlow-Bates' book, 0.002 BTC each, 0.008 BTC total, unsolved for roughly 4 years before. Methods: BIP39 mnemonic repair, XOR of printed hashes, English to Italian wordlist localization, and triple-SHA256 of a hidden phrase. See finlow-bates-solutions.
  • 0.5 ETH claimed on Teikhos bounty 735B, by recovering a winning ECDSA public key that had leaked in a failed 2022 attempt's calldata. See teikhos-735b.

Protocol security

  • 8 bugs (Critical and High) reported on the Akash BME incentivized testnet, each with a reproduction: stuck mints, vault, lease and escrow state inconsistencies, and an oracle config mismatch. See akash-bme-testnet-bugs.
  • Ongoing differential research on Ethereum execution and consensus clients, and zkVM soundness.

DeFi and ZK

  • 1st place, $70,000 of a $100,000 prize pool at the Aleo Hackathon (KRYPTOSPHERE x zSociety, 2025) for Eclipse, a private lending protocol on Aleo: a decentralized price oracle (staking, slashing, on-chain median aggregation) plus an over-collateralized USDA vault and a permissionless lending pool, written in Leo. See aleo-eclipse.
  • MBC-20, an inscription-style token standard and indexer on Base. See mbc20.

Approach

I use AI (Claude Code) to accelerate the search and clustering pipeline, not to read the contracts. Automated tooling tends to give up on exactly the contracts worth a closer look, so the judgment stays manual.

Contact

X @0xFlorent_ · ENS 0xflorent.eth

Pinned Loading

  1. EclipseAleo/aleo-eclipse EclipseAleo/aleo-eclipse Public

    Eclipse: a private lending protocol on Aleo (oracle + USDA vault + lending pool) in Leo. 1st place, Aleo Hackathon 2025.

    Leo 2 2

  2. hongcoin-recovery hongcoin-recovery Public

    White-hat recovery of ~1,003 ETH stuck in the 2016 HongCoin ICO contract

    Solidity

  3. claude-rag-skills claude-rag-skills Public

    Professional RAG development skills for Claude Code - audit, evaluate, optimize, and scaffold RAG pipelines

    33 3

  4. akash-bme-testnet-bugs akash-bme-testnet-bugs Public

    8 Critical/High bugs found on the Akash BME incentivized testnet, each with a reproduction

    Shell

  5. finlow-bates-solutions finlow-bates-solutions Public

    Solutions to four Bitcoin key puzzles hidden in Kary Finlow-Bates' blockchain book

  6. teikhos-735b teikhos-735b Public

    How the 0.5 ETH Teikhos 735B bounty was solved by recovering a leaked public key