This is a loose archive of security work I've done for open-source projects, including security engineering and source code reviews.
Note: this is a best-effort list of public work only. Much of my audit and security engineering output is under confidentiality agreement and cannot be listed.
- Audits: 9 published reports as primary auditor, including 4 critical findings in ZetaChain Node and 1 critical finding in Groth16 Verifier.
- Code review: reviewed 1,255 public pull requests, leaving 3,586 inline comments across 712 of them.
- Authored: 813 public pull requests, 611 merged.
| Area | Work | PRs |
|---|---|---|
| Wormhole Guardian | Added the Transfer Verifier mechanism to the Guardian node, integrated it into the Ethereum watcher, and wrote its whitepaper. | #4169, #4233, whitepaper #4242 |
| Wormhole Guardian | Extended Governor flow cancel with a configurable allow-list of chain ID pairs, and added the Notary package for verifying message publications. | flow cancel #4229, Notary #4315 |
| Native Token Transfers | Added fuzzing and overflow checks for TrimmedAmount in the Solana program, and wrote INVARIANTS.md to support security assessments. | #269, #684 |
Machine-readable exports: summary · events · capability graph · finding patterns
- Wormhole Guardian (184 merged PRs, 10 issues, 120 reviews in 2026)
- Review: Canton chain integration Substantial review and design feedback on the Canton integration PR (developed on the WormholeLabs fork).
- Wormhole Native Token Transfers (18 merged PRs, 25 issues, 11 reviews in 2026)
- Wormhole Liquidity Layer (7 issues)
- Wormhole Solidity SDK bug reports
- Clarity-Go Parser (4 issues)
- Commonware monorepo (2 issues)
- Solana M (9 merged PRs)
- Solana M Extensions (11 merged PRs)
- Solana M: claim yield calculation walked incomplete index history
- LORIS Neuroimaging Software (407 merged PRs, 207 issues)
- Ghostfolio: insecure randomness for new passwords Password generation used insecure randomness; reported and fixed via PR.
- node: Upgrade go-libp2p to v0.46.0
- Add testutils pkg; use TimeFromUnix when building message publications
Formal audit reports for which I was the primary auditor.
| Date | Title | Client | Type | Language | C / H / M / L / I | Report |
|---|---|---|---|---|---|---|
| 2023-08-06 | Tricorn Bridge Server Security Assessment | BoostyLabs | EVM, Bridge | Go | 0 / 3 / 2 / 10 / 9 | Report |
| 2023-05-12 | Groth16 Verifier Audit | Mysten Labs (Sui Foundation) | Cryptography, ZK | Rust | 1 / 0 / 1 / 6 / 1 | Report |
| 2023-03-31 | ZetaChain Node Security Audit | ZetaChain | Cosmos, Bridge, Bitcoin | Go, Solidity | 4 / 5 / 6 / 6 / 0 | Report |
| 2023-01-25 | Maya Node Security Audit | MayaChain | Cosmos, Node | Go | 0 / 2 / 0 / 12 / 4 | Report |
| 2023-01-18 | Maya Node Liquidity Auction Audit | MayaChain | Cosmos, DeFi | Go | 0 / 2 / 1 / 4 / 2 | Report |
| 2022-11-24 | Mars Protocol Custom Modules Audit (Governance, Incentives, Safety) | Mars Protocol | Cosmos, Governance, DeFi | Go | 0 / 1 / 0 / 3 / 3 | Report |
| 2022-09-08 | Sifchain Margin Audit | Sifchain | Cosmos, DeFi | Go | 0 / 0 / 1 / 1 / 2 | Report |
| 2022-07-08 | Sifchain CLP Update Audit | Sifchain | Cosmos, DeFi | Go | 0 / 0 / 1 / 2 / 1 | Report |
| Maya Node ETH Router Audit | MayaChain | Cosmos, DeFi | Go | n/a | Report |
Personal website: https://johnsaigle.com
- Boredom Over Beauty: Why Code Quality is Code Security
- Solana Vulnerabilities That Aren't — Unpacking Common Misreports
- Top 5 Security Vulnerabilities Cosmos Developers Need to Watch Out For
- Don't “Panic”: How Improper Error-Handling Can Lead to Blockchain Hacks
- locked-in -- lint for unsafe package installation patterns
- go-unmaintained -- find abandoned packages via go.mod
- Anchor version detector
- Scary Strings -- dangerous-function wordlists
- skill-issues -- prompt injection scanner for markdown and agent files
- hermit -- linter for curl | bash patterns
- audit-notes -- markdown scaffolding for security audits
- persona -- local-first PII detection and redaction
- Neovim security/SAST diagnostics integrations
- Oblique Strategies for Hackers
- channelcheck -- detect dangerous Go channel operations