KHASBI.M
Full-Stack Developer building Web3 agents,
secure smart contracts, and onchain products.
I'm a Full-Stack Developer focused on Web3 infrastructure, AI agents, and smart contract security.
Creator of web3-agent-kit — an open-source Python SDK for autonomous blockchain AI agents, with 22,000+ PyPI downloads and 1,971 tests across 9 chains.
I work across the stack: Python for AI/ML backends, TypeScript/React for interfaces, Rust/Go for performance tools, and Solidity for smart contracts.
Active security researcher. I've audited DeFi protocols, found critical vulnerabilities, and earned bug bounties from Immunefi and Bugcrowd.
Python SDK for autonomous blockchain AI agents. 25 modules, LLM provider cascade, multi-chain support, and 1,971 passing tests. v1.18.5 registers Base Sepolia as a first-class chain and ships the WAK/Insight/PriorSeal conformance spike, on top of the enforced pre-sign authorization gate on every write path.
Independent four-round review of the pre-sign authorization gate with a live counterparty. Four defects found and closed, ending in a verified cross-network run: signed oracle assessment → policy → principal authorization → exact-call execution → onchain verification.
Decentralized payment gateway on QIE Blockchain — crypto payments with escrow, auto-settlement, POS mode, and analytics.
Exposed Spring Boot Actuator gave full access to MMBot infrastructure, logger modification, and trading strategy leak. $180M TVL at risk.
API security vulnerability on a perpetuals trading platform. Reward increased to $400 with a bonus after the initial report.
Responsible disclosure on self-custodial payments infrastructure — global digital-dollar transfers with no custodial intermediary.
Two live exchange API keys found leaked in public wallet-app repositories, plus a quote markup parameter that accepted out-of-range values — a $626 quote reduced to $6.21.
Futures backend trusted client-supplied entry and exit prices — arbitrary PnL and platform volume minted from a single account. Social-reward and fee-deduction bypasses found in the same API.
Admin API reachable by any registered account: platform metrics, high-value card transactions, and mass-notification endpoints had no server-side role check.
Unauthenticated private key export on all user wallet pockets. Full attack chain proven: scan pockets, export keys, sweep funds.
Firebase Admin SDK custom token leaked via unauthenticated API — full account takeover, email flooding, and persistent access.
Production source map exposure on console.aiven.io — 2,642 files, 21MB, leaking OAuth secrets and internal API routes.
Production source map and Sentry exposure on cloud console infrastructure.
CORS misconfiguration and undocumented endpoint exposure on an agentic platform.
Agentic Engineering grant, funded for open-source agent infrastructure work.
From architecture decisions to PyPI release — how I built a production-grade Python SDK with automated testing and LLM integration.
Read on GitHub →What failed automation bots taught me about building in public, landing clients, and why your portfolio matters more than your code.
Read on LinkedIn →Auditing DeFi protocols, finding vulnerabilities in smart contracts, and responsible disclosure through bug bounty programs.
View Research →Active across Base, Arbitrum, Optimism, Celo, Solana, and Sui — bridges, swaps, airdrops, and onchain interactions.
Deployed 9+ verified contracts. ERC-20, ERC-721, and custom DeFi patterns including swaps and token interactions.
Bug bounty hunter — found vulnerabilities in Solana privacy protocols and multi-chain DeFi aggregators through responsible disclosure.
Web3 community focused on airdrop farming, testnets, and ecosystem updates. Regular content on DeFi and security.
t.me/mancingdao →@ulsreall on GitHub
Open for full-time roles, freelance projects, Web3 development, and security research collaborations.