sfrxETH Withdrawal Underflow
Cached totalAssets drifted against live figure in Frax's sfrxETH withdrawal path, stranding LP redemptions. Runnable Foundry PoC against mainnet fork.
Leonard Sambu
Security Researcher | Smart Contract Auditor | AI Agent Engineer | Fullstack Developer
Now
Security researcher and smart contract auditor. I find arithmetic bugs in code that holds other people's money — then ship the products I build for people who can't hire a security team.
Currently: independent audits across Frax, Paxos, USDai, Cetus. Building farm management PWAs (Maziwa Coop, Sambu Farm Manager) on Cloudflare Workers + D1. Weather intelligence for 47 Kenyan counties via Shambani. Producing AI video content for YouTube and TikTok, with four years as a studio technical director and editor before generative AI.
Bug Bounty Programs
0
Smart Contract Audits
0
Farm Apps Live
0
Video Channels
0
Skills
Security & Auditing
Blockchain & Web3
Fullstack & Tools
AI & LLMs
Media & AI Video Production
DevOps & Infra
Security Research
60+ bug bounty programs across HackenProof, HackerOne, Bugcrowd, Immunefi, OKX. 20+ smart contract audits. Proudest finds are arithmetic: sfrxETH underflow, tokenize.it exit drain.
tokenize.it Exit Payout Drain
Caller-supplied base price let a co-investor walk off with an entire exit. Complete breakdown of server-side authorization checks.
Blind Stored XSS → PII Leak
Injected Blind XSS payload into public registration form; executed in authenticated backoffice dashboard. Leaked National IDs, Phone Numbers.
Sequential IDOR Address Manipulation
Sequential numeric identifiers allowed unauthenticated manipulation and deletion of other users' addresses. Complete authorization bypass.
Blockchain Audits
Independent security audits of DeFi and L2 protocols. Comprehensive Foundry PoCs with mainnet-fork verification. Protocols include Frax, Paxos, USDai, Cetus, Revert, Alberich, Zendex, DreamX.
Underflow in withdrawal path where cached totalAssets drifts against live figure, stranding LP redemptions.
Access control state inconsistency allowing unauthorized mint/burn operations under specific governance transitions.
Storage growth DoS via unbounded mapping iteration in reward distribution mechanism.
Concentrated liquidity math edge case allowing position manipulation during tick boundary transitions.
Message passing verification gap allowing replay under specific finality conditions.
Interest rate model manipulation via precision loss in utilization calculation at extreme bounds.
Projects
Production applications spanning farm management, African agronomy, Web3 and AI tooling. All installable PWAs with offline-first architecture.
Sambu Farm Manager
Farm PWAReplaced physical payroll workbook of a Kenyan tea estate (20–30 pluckers, 12–39t green leaf/month). Piece-rate/day-rate/prorated pay engine; KALRO-based feed-ration solver for livestock. Migrated IndexedDB/FastAPI/Docker → Cloudflare Workers + D1.
Maziwa Coop
Dairy PWADaily milk logging for Kenyan dairy cooperatives. Africa's Talking SMS confirmations to farmers. Milking-can credit tracking. CSV reporting. SMS provider abstracted for swap without core changes.
Shambani
Weather + Agri AIWeather intelligence for all 47 Kenyan counties: current conditions, 7-day forecast, AI agronomic advice grounded in KALRO, Tea Research Foundation, Ministry of Agriculture guidelines. Livestock feed profiling. Server-side API keys, stale-on-error cache.
QuitVaping
Health PWAFlutter web PWA for nicotine cessation: abstinence tracking, health-recovery timeline, savings calculator, AI coach, craving-pattern analysis, guided panic-mode breathing. RevenueCat monetization. Full MCP client stack. 36k lines Dart, 117 files.
FinPro
DeFi PlatformClient delivery: escrow payments, ERC-20 token, swap module, multisig treasury, EIP-4337 gasless accounts with token paymaster, Telegram Mini App. 7 audited Solidity contracts, 33 passing Hardhat tests.
BotIn
Agent NetworkDecentralized AI agent professional network utilizing ERC-8004 for agentic identities, on-chain reputation and XMTP messaging.
Uplift
News PWAPositive-news aggregation platform with bilingual English/Swahili Groq classifier. Installable PWA with push notifications.
NimbusTrade
Arb DashboardWeb3 arbitrage dashboard combining Polymarket CLOB APIs and Gemini-powered Expected Value logic.
PicKut AI
Image EditingProfessional image editing suite powered by Gemini 2.5 Flash Image, featuring ERC-8004 agentic Web3 payments and gasless subscriptions over EIP-4337.
SafeShamba
Escrow PWANotary-mediated land escrow with multisig custody and state-gated fund releases. Four-phase workflow: intake, safety gate (due diligence), execution/fiat bridge, transfer registry. Solidity contracts audited with Foundry (21 passing tests) and Slither; React 18 + ethers.js + Vite frontend on Cloudflare Pages.
c0bw3b Toolkit
13,000 lines of Python across 31 modules and 107 passing tests, automating reconnaissance and verification behind my bug bounty practice.
- Comprehensive JavaScript secret analysis and extraction
- Integrated Nuclei scanning with custom templates
- Asynchronous port scanning and service fingerprinting
- Passive and active subdomain enumeration
- Cloud service takeover detection
- Historical URL collection (Wayback, CommonCrawl)
- Automated detection of CORS, IDOR, SQLi, SSRF
- False positive verification and attack chain detection
c0bw3b@local:~$ ./c0bw3b run --target example.com
[INFO] Starting reconnaissance pipeline...
[+] Module js_analyzer initialized
[✔] Found 3 exposed API keys
[+] Module nuclei_runner scanning endpoints
[+] Module port_scanner analyzing 80 common ports
[✔] Discovered 4 open ports
[+] Module url_collector fetching history
... retrieved 5,030 URLs
[INFO] Initiating vulnerability modules
[!] Potential High-Severity IDOR detected
[!] Validating SSRF candidate on /api/proxy
c0bw3b@local:~$ _
Experience
Technology Consultant & Developer
Self-Employed
- Built and deployed production full-stack applications (Maziwa Coop, Sambu Farm Manager) on Cloudflare's serverless edge with JWT auth, RBAC, and live D1 schema migrations.
- Paid incident response and forensics on WordPress estates: recovered client across four outages, removed PHP webshell and eight hidden admin accounts, rotated salts, cut TTFB from 30s+ to 1.1s.
- Architected lead pipeline connecting Meta Lead Ads to CRM via Cloudflare Workers + KV, with Zapier bridge around Meta's App Review restriction.
- Engineered and audited Solidity contracts using Slither, Mythril; reduced exploit risk surface by 40%.
Project Manager
SIZLAND Limited
- Orchestrated Agile/Scrum workflows in Web3 environment via JIRA and Trello.
- Delivered 39k-line content curation platform and notary-mediated escrow system with smart contracts, front-end ABIs, handover documentation.
Indie Game Developer
Jampack Incubator
- Developed Mathlantis, educational web app for Games for Love.
- Awarded "Most Child Friendly Game" title badge.
Director and Manager
Sambu Academy
- Directed educator teams and implemented SOPs that boosted productivity by 30%.
Technical Director & Firm Manager
KASS Media
- Led technical operations, logistics, and firm management over multi-year tenure. Studio production, live broadcast direction, post-production editing (DaVinci Resolve, OBS Studio).
Certifications
Professional & Technical
Security & Defense Training
Personal Development
Reach
Open to security research collaborations, smart contract audits, and production engineering engagements. Also building AI video production capabilities for agency partnerships.
Media & AI Video Channels
Documents & Downloads
CV — Sambu Leonard
Modern CV with Rare UI design · 4 pages · PDF
Download →
SkillQuest — Generative AI Literacy
SkillUP by Simplilearn · 92% · Cert. No. 44822733 · PDF
Download →
Maximizing Organizational Trust
DCSA · 2024 · PDF
Download →
Leveraging Virtual Assistants for Personal Productivity
Coursera Instructor Network · 2024 · PDF
Download →
Develop a Company Website with Wix
Coursera Project Network · 2022 · PDF
Download →
Built with Fraunces + Inter. Motion via Framer Motion. No framework. Deployed on GitHub Pages.