Francisco Antonio

This research started with a simple question: where exactly is the boundary between the EVM execution environment and the Cosmos SDK state machine, and does every security assumption survive the crossing?

Instead of poking at public RPCs, I built the environment myself. I compiled the node software from source, patched the genesis configuration, enabled the relevant precompiles, and wrote Go tests around StateDB behavior so I could observe exactly what the chain believed about an account at every step of execution.

The core discovery came from understanding transient EVM execution phases. During deployment, a contract can look very different from a normal deployed contract — and an authorization check that assumes otherwise can be convinced it is talking to something it is not. I built a proof-of-concept and a full local reproduction showing that a smart contract could violate an explicit security policy, then expanded the research into a persistent lifecycle vector using deterministic deployment and same-transaction lifecycle behavior.

The report was triaged and reproduced. Later, it was closed under platform and program eligibility rules — not because the technical work was disproven. That distinction matters, and so does how a researcher responds to it. I chose not to publish weaponized exploit details, because responsible disclosure and user safety matter more than frustration.

The lesson I took from the whole process: documentation, methodology, and ethical boundaries are not the boring part of security research. They are the portfolio.