Portfolio of audits and certificates

About me

I am a cybersecurity expert with more than eight years of experience in the industry. For three years associated with blockchain technology as a Lead Smart Contract and Blockchain auditor. I conducted over 110 audits of various protocols, mostly related to Decentralized Finances. I am specializing in the security of contracts written in Rust, Golang and MOVE, in technologies such as CosmWasm, Sui/Aptos/Movement, NEAR, Ink!, Substrate and Solana, as well as i have a deep technical understanding of EVM and Solidity. I participated in assessments testing low-level aspects of blockchain technology, such as finality proof verifications, serialization libraries, rollups as well as implementations of bridges between many different ecosystems. I have an experience in auditing Layer 1 Blockchains written in Rust, Golang and MOVE. Additionally, i have an experience in testing offchain components such as wallets, infrastructures, oracles and Metamask Snaps. My experience covers also more niche languages, such as Pact, Noir and Rell. Before moving to Web3, I was a Lead Security Researcher and Penetration Tester managing a team of up to 10 engineers. I am also specialized in low-level binary exploitation in both UNIX and Windows environments. Holder of OSCP, OSCE and Lead ISO27001 Auditor certificates.

CEO & Cofounder at Monethic. Currently, I'm also an ASR at Spearbit, Lead Blockchain Security Auditor at Oak Security, Zenith, Sub7, Sayfer, Formal Verification Ambassador at Certora and Lead Smart Contract Security Auditor at Hacken. Additionally, i am a judge on Cantina.

For private audits or security consulting, please reach out to me on:

• Twitter - @JakubHeba
• LinkedIn - Jakub Heba

You can also request a quote on Monethic or Cantina.

---

Current public reports count: 86

---

Private & Solo Audits

Audits in a team

Certificates

• Offensive Security Certified Expert (OSCE) - Offensive Security OSCE proof
• Offensive Security Certified Professional (OSCP) - Offensive Security OSCP proof
• Lead ISO27001 Auditor - Information Security Management Systems (ISMS) Auditor/Lead Auditor (BS ISO/IEC 27001:2013)

0 day vulnerabilities found which were assigned CVE numbers - mostly web applications

• CVE-2019-10070 - Apache Atlas, Stored Cross Site Scripting
• CVE-2020-6856 - JOC Cockpit, Jobscheduler, XML External Entity
• CVE-2020-6854 - JOC Cockpit, Jobscheduler, Multiple Stored Cross Site Scripting
• CVE-2020-6855 - JOC Cockpit, Jobscheduler, Denial of Service
• CVE-2021-3584 - Foreman, Authenticated Remote Code Execution via Sendmail configuration