Everything I've shipped, in one list.

S2morrow, the post-quantum wallet on Starknet

A Starknet account secured by Falcon-512 instead of ECDSA. On top of StarkWare's Falcon verifier I wrote the account contract, the encoding that packs a 512 coefficient public key into 29 storage slots, the WASM signer and the browser wallet: 63K Cairo steps and 62 calldata felts per verification, benchmarked against an ECDSA account on real L2 gas.

Built in the open from 27 January 2026, posting the work daily:

1. 27 Jan “Quantum computers will eventually break every wallet on Ethereum. I'm going to build a performant post-quantum wallet using Falcon-512 on Starknet.”
2. 28 Jan “I found a 65% overhead in the Falcon-512 verification. Not math related, it's just the Cairo VM fighting itself.”
3. 30 Jan “Turned an elegant NTT algorithm into a brutal 30k-line assembly file. It's nasty but 5x faster.”
4. 10 Feb “Two teams independently wrote the same 10,000-line file. One runs 4x faster. The difference is one subtle design decision.”
5. 12 Feb “The costs are literally annihilated now, only 63k steps per Falcon-512 signature. I used to target 200k.”

On 1 April StarkWare shipped it: “S2morrow is in production now, directly on Starknet Mainnet.” Their launch article sends readers to s2morrow.xyz and to my repo. It was covered as S2morrow by ForkLog, Crypto Times, Quantum Zeitgeist and Castle Labs. OpenZeppelin's post-quantum account repository was created on 24 June 2026, five months after I started and three after it shipped.

Privacy Pools security audit

Sole auditor of the Starknet implementation: Cairo contracts, Groth16 verifier integration and the LeanIMT Merkle tree. Circuit constraints were out of scope. 27 observations, 1 high, 3 medium, 22 resolved against linked fix commits.

Herodotus offchain EVM headers processor

Wrote the Cairo offchain programs proving Ethereum's entire block history via STARK proofs. Merkle Mountain Range accumulators with Poseidon and Keccak hashing. Two engagements across 2023 and 2024.

BTQ, Falcon on Starknet

Cairo development and consultation for BTQ Technologies on the first Falcon signature verification in Starkware, in 2023. Their write-up closes: “We'd also like to thank feltroid prime for his contributions to the Cairo development and consultation throughout the project.” The page has since been taken down, so the link is to the archive.

SP1 on Starknet

Verifying SP1 zkVM proofs on Starknet. Reference template for teams bridging Rust-proven execution onto Cairo.

Cairo performance work

Garaga Zero for the original Cairo toolchain. Profiling tooling and agent skills for optimising Cairo, adopted into StarkWare's agentic repo. Merged optimisations into Raito, including a 10x cheaper digest conversion.

Breaking and fixing gnark

Reported a soundness bug in gnark's BN254 pairing verification: a malicious prover could supply the hints w = c^λ/f and satisfy the in-circuit check anyway. gnark's own cryptographer filed it, crediting the report to me. gnark is the most widely used Go proving library on Ethereum.

Two years later an AI auditor found the same bug in OpenVM, filed critical as CVE-2026-46669: the scaling factor was never constrained to the proper subfield, so a prover setting c = 1 and u = f⁻¹ forced any pairing check to pass. OpenVM's advisory points at gnark as the implementation that gets this right. That check is the patch from my report.

Also found and fixed a convergence failure in Eisenstein Half-GCD, merged into gnark-crypto and credited in the v0.18.0 release notes.

Extension field arithmetic

A November 2023 note showing that extension field multiplication can be done directly instead of through towers, with Schwartz-Zippel verification. It is the groundwork Garaga's multi-scalar multiplication is built on, the CryptoExperts auditors cite it as reference documentation, and Ivo Kubjas of the gnark team put it on screen and credited it by name at Devcon 2024.