bug bounty researcher · smart contract security
I hunt for security flaws in smart contracts and web3 protocols — read the scope, review the code line by line, prove every finding with a working PoC, then report. This page is my track record: reports I've submitted and hunts I've completed — stated as they are, including the ones that were cancelled and why.
I'm HDR — an independent bug bounty researcher from Indonesia. My focus is smart contract and DeFi protocol security: staking, AMMs/DEXs, bridges, and on-chain reward systems.
My workflow is simple and never changes: the scope gets read before any recon happens, every finding is proven with a working PoC, and everything is checked for duplicates before it is submitted. A finding that doesn't meet that bar doesn't get filed — I'd rather finish a hunt with no report than file a sloppy one.
I also hold two principles that decide which targets I take on: no KYC and no submission deposits or fees. A few solid findings had to be parked or cancelled because of that — all of them are recorded honestly in the hunt list below.
Three reports officially filed with a platform. Statuses are stated as they stand as of October 2026 — no payout has been confirmed for any of the three.
A zero-voting-power (zero-VP) reward-asset blacklist permanently freezes / orphans already-deposited reward funds — there is no recovery path for the funds' owner.
Submitted · awaiting triage · no confirmed payout yetA zero-VP pool blacklist causes LP emissions to be permanently skipped for the entire blackout period — the missed emissions can never be claimed afterwards.
Submitted · awaiting triage · no confirmed payout yetBinPositionManager (BSC) performs no per-bin minLiquidities check, enabling LP share dilution via a sandwich attack. The finding was proven with a verified PoC before submission.
Closed · duplicate of report #77530Hunts that were fully worked through but never became submissions. The reasons are stated plainly: some valid findings hit platform gates, others came back clean after a full review — an honest negative result is still a result.
A Medium finding that passed its PoC and was duplicate-clear. Cancelled because Sherlock requires a 250 USDC submission deposit — which conflicts with my no-deposit principle.
An improvement proposal saving 21,785 gas per swap, passing 678 tests, and duplicate-clean. Parked because the program gates submissions behind a reputation score of 100, while the Hdr account sits at 80.
validateAddress() performs no checksum validation for BCH legacy, Dogecoin, and Stellar addresses — a one-character typo passes validation and can lock withdrawal funds. PoC-verified (6/6 tests) and duplicate-clean. Cancelled over the $5 submission fee.
The stake(user, …) function in IDOSNodeStaking lets anyone stake another user's tokens out of the victim's allowance — tokens locked for 14 days, and permanently lost if the node is slashed. PoC-verified in Foundry (3/3 tests) and duplicate-clean. Cancelled over the $1 submission fee — the no-fee principle holds no matter how small the amount.
Hunt completed on Sep 30, 2026: 70+ candidates examined across 3 review tracks. None reached the submittable bar — closed as a negative result.
Three programs reviewed end to end — including thorough deduplication against more than a dozen prior audit reports on Twyne. All three finished with 0 submittable findings.
DeXe and Chainlink reviews completed; the CCIP 2.0.0 codebase (~7,000 lines) was reviewed clean. Nothing worth reporting — 0 submittable.
All 16 live programs with a free submission path were swept and reviewed across two sweep rounds (including Bitunix, OFZA, BitDelta, PointPay, Bitkub/Tickets, DeltaPrime, and Cronos zkEVM). Final result: 0 submittable.
A multi-round audit of the Blohard protocol on mainnet. The strongest findings were design/griefing-level issues at the protocol layer — not theft-grade — so it was closed without a report: 0 submittable.
Alongside security research, I compete in open bounties on poidh — an on-chain bounty platform where anyone can post a task with an ETH prize pool and anyone can submit a claim. The submitted claims below were filed as @Hdr284 and verified live on poidh — and where a claim hasn't been filed yet, it says so. None of these has been paid out — each status is stated exactly as it stands.
Submitted claims
Prize pool 0.5 ETH (~$1,204). Claim #156, entry name "Spread" — one proposed name with its rationale and a square image, submitted into a field of 15 claims.
Submitted · awaiting Seer team vote after Oct 24, 2026Prize pool 0.5 ETH (~$1,204), plus 4,000 USDC if a non-internal submission wins. Claim #171, entry "Convergence" — a unified design system across six working interface demos, with a public repo at github.com/hdr2804/seer-convergence.
Submitted · awaiting Seer team vote after Oct 24, 2026Prize pool 0.13035 ETH (~$306). Claim #149, "The Ascent" — a ~85-second film adaptation of Snowmoon Chapter 6 (the Keeper confirmation), published in an X post with an open-source repo at github.com/hdr2804/snowmoon-the-ascent. One of 14 claims.
Submitted · awaiting winner nomination / vote after Oct 19, 2026Prize pool 0.0082 ETH (~$20). Claim #8857, "The question never travels" — an original X post arguing for private AI, tagging @boar_app.
Submitted · winner picked by the issuer after Oct 31, 2026Published — claim pending
Prize pool $15.85. A 45-second explainer video — what poidh is, how it works in four steps, and why it counts as freedom tech — published on X by @Hdr284 on Oct 17, 2026.
Content published · claim not yet submitted · deadline Oct 24, 2026Completed participation
Joined as a verified recruit — slot 20 of 20 — with the agent "USAM" verified on Sep 28, 2026.
Participation completed · verified recruitClaim not accepted
The claim was submitted for this 0.04 ETH bounty on Arbitrum, with the implementation delivered as GitHub PR #1541 — which was closed unmerged and unreviewed on Oct 3, 2026. At the last live check (Oct 5, 2026), the bounty itself was still open with all 3 claims present and no winner selected: the PR was closed unmerged and the claim was never accepted.
PR closed unmerged · claim never accepted · no winner selected at last checkA program's scope page is always read first, before a single request is sent or a single line of code is touched. There is never any out-of-scope recon — targets outside the official list are not touched at all.
Every finding must be proven with a proof-of-concept that actually runs — local Foundry or Vitest tests, not theory from reading code. If it isn't proven, it isn't reported.
Before filing, every finding is cross-checked against public audit reports, changelogs, and issue trackers. One of my reports still ended up closed as a duplicate — that's an accepted risk, not a reason to skip the check.
I only hunt programs that can be submitted to — and paid out — without identity verification and without putting money up front. The consequence is real: several valid findings were never filed, and that consequence is written down plainly on this page.
The fastest way to reach me: DM me on X for a chat and the latest hunt updates, or check GitHub for the code and experiments I publish.