This repository is a public portfolio for JohnWeb3, an independent smart contract security researcher focused on EVM and Rust protocol security, contest audits, private reviews, and vulnerability research.
I am available for smart contract audits, private security reviews, and web3 security consulting.
- GitHub: johnyfwesh
- X: @konvati
- Telegram: @K54bf
- Discord:
johnyfwesh - Email: [email protected]
- Sherlock: JohnWeb3
- Code4rena: johnyfwesh
- Immunefi: Johnyfwesh
- Cantina: johnyfwesh
- HackenProof: JohnWeb3
Known public handles: JohnWeb3 and konvati.
👋 Hi, I am JohnWeb3, a smart contract security researcher interested in helping web3 teams ship safer protocols. My public work spans competitive audits across Code4rena, Sherlock, Cantina, Immunefi, and HackenProof, with findings covering access control, reentrancy, accounting, denial of service, oracle/rate-limit logic, signature replay, and protocol-specific economic edge cases.
My background also includes blockchain engineering, full-stack development, and cybersecurity research, which helps me review protocols from both implementation and system-design angles.
Public profile stats last verified on June 15, 2026.
| Source | Public stats |
|---|---|
| Sherlock | 12 High, 20 Medium, $17.11K earnings, #478 all time, 22 payouts, 1 second place, 3 top 10s |
| Code4rena | $16.18K total earnings, $11.14K this year, #276 all time, #24 this year, 8 High, 11 Medium |
| Cantina | $699.56 public earnings, 14 public findings, #674 leaderboard |
| Immunefi | $354 total earnings, 1174th all time, 3 audit competition reports, 1 High, 2 Low |
| HackenProof | Rank 2442, reputation 140, available for hire, hall-of-fame mentions for Swafe and Succinct |
- 2nd place in Swafe, identifying 2 medium-risk findings.
- 4th place in Succinct, identifying 1 medium-risk finding.
- 4th of 59 in Revert Finance on Cantina.
- 8th place in SukukFi, identifying 1 high-risk finding.
- 12th place in Panoptic: Next Core, identifying 2 high-risk findings.
- Reported 2 high-risk findings in Super DCA Liquidity Network on Sherlock.
- BuilderWallet
init()is unprotected/re-initializable, enabling takeover and theft of builder fees - Panoptic: Next Core - Cross-contract reentrancy in liquidation enables conversion of phantom shares to real shares - Panoptic: Next Core
- Missing access control in
WERC7575Vaultallows unauthorized withdrawals - SukukFi set_invocation_costs_config()fails to authorize admin allowing anyone to set invocation costs - Reflector V3- Fee collection DoS on native currency pools - Super DCA Liquidity Network
- Bucket reward wipe via stake/unstake index reset - Super DCA Liquidity Network
- Total reward shares for token can reach zero after unlocking - GTE Perps and Launchpad
- Remote process crash via post-serialization size check and large batch aggregation - Monad
- Session signatures replay across wallets due to missing wallet binding - Sequence
- Arbitrum Retryable-Ticket Refund/Value Not Verified Enables Timelock ETH Exfiltration - Olas
| Contest | Date | Findings | Rank | Reports |
|---|---|---|---|---|
| Olas | Jan 2026 | 1 M | #53 | S-606 |
| Panoptic: Next Core | Dec 2025 | 2 H | #12 | S-501, S-654 |
| Rujira | Dec 2025 | 3 H, 2 M | #53 | Finding not yet public |
| SukukFi | Nov 2025 | 1 H | #8 | S-692 |
| Swafe | Nov 2025 | 2 M | #2 | S-518, S-521 |
| Reflector V3 | Oct 2025 | 1 H, 2 M | #14 | S-513, S-552, S-595 |
| Sequence | Oct 2025 | 1 M | #11 | S-447 |
| Monad | Sep 2025 | 1 M | #13 | S-767 |
| Succinct | Sep 2025 | 1 M | #4 | S-282 |
| GTE Perps and Launchpad | Aug 2025 | 1 H, 1 M | #75 | S-751, S-752 |
| Contest | Platform | Date | Findings | Rank | Reports |
|---|---|---|---|---|---|
| Clear Macro by Superfluid | Sherlock | Apr 2026 | No public finding listed | #128 | Contest |
| Current Finance | Sherlock | Mar 2026 | 2 M | #22 | #1031, #1200 |
| OpenCover Insured Vaults | Sherlock | Jan 2026 | No public finding listed | #140 | Contest |
| Flying Tulip | Sherlock | Jan 2026 | No public finding listed | #209 | Contest |
| Monolith Stablecoin Factory | Sherlock | Dec 2025 | 1 M | #25 | #1488 |
| Super DCA Liquidity Network | Sherlock | Sep 2025 | 2 H | #44 | #466, #477 |
| Contest | Date | Findings | Rank | Report |
|---|---|---|---|---|
| Revert Finance | Mar 2026 | 1 M | 4 / 59 | Finding not yet public |
| Revert Finance - StableSwap Hooks | Apr 2026 | 4 total findings | 21 / 269 | Finding not yet public |
| VII-Finance-Contracts | Jan 2026 | 1 H shown in Sherlock aggregate | 22 / 96 | Finding not yet public |
| Avon-Contracts | Oct 2025 | 3 M | #11 | Finding not yet public |
| Competition | Date | Public result | Report |
|---|---|---|---|
| Audit Comp - Folks Finance: Staking Contracts | Mar 2026 | Ranked #29, $340 payout | Finding not yet public |
| Audit Comp - Vechain - Stargate Hayabusa | Nov 2025 | Ranked #47, 14 USDT payout | Finding not yet public |
| Audit Comp - Alchemix V3 | Oct 2025 | Ranked #159 | Finding not yet public |
| Profile | Public status |
|---|---|
| JohnWeb3 | Security Researcher, Nigeria, available for hire |
| Reports | No disclosed reports at the moment |
| Hall of fame | 2nd in Swafe Contest, 4th Succinct Contest |
- GitHub profile
- Sherlock profile
- Code4rena profile
- Immunefi profile
- Cantina profile
- HackenProof profile
👋 Hi, I'm John, a Blockchain Engineer, Full-Stack Developer, and Cybersecurity Enthusiast passionate about building secure, scalable, and innovative tech solutions. I specialize in:
🔁 Blockchain Development (Smart Contracts, Solidity, Web3)
💻 Web Development (JavaScript/TypeScript, React, Node.js)
🔐 Cybersecurity (Penetration Testing, Smart Contract Audits)
💻 I love working on projects that blend cutting-edge technology with real-world impact. Check out my latest work on decentralized applications, sniper bots, and hosting platforms!
🌐 Portfolio: link
📜 Blog: medium.com/@okoyejp (Sharing insights on blockchain, web3, and cybersecurity)
📧 Let's connect: Email John
