SpectraSec Labs
Smart Contract Audits · Penetration Testing · Web3 Security Research
I'm Mustapha — a smart contract engineer and security researcher. I dig into your code so attackers don't get the chance to.
What I Do
I find the bugs that cost protocols millions. Here's how.
Smart Contract Audits
Manual + automated security review of DeFi, NFT, and DAO smart contracts with detailed vulnerability reports and remediation guidance.
Penetration Testing
Web, mobile, API, and network pentesting using OWASP, PTES, and MITRE ATT&CK frameworks. Full report with PoC exploits.
Security Research
Independent vulnerability research, CVE discovery, and bug bounty hunting across DeFi protocols and Web2 targets.
Web3 Development
Security-first smart contract development, DApp building, and blockchain integrations using Solidity, Foundry, and Hardhat.
Mobile & Web Development
Secure, modern applications for Android, iOS, and web with security built into every layer of the stack.
Cybersecurity Consulting
Strategic security advisory, risk assessments, threat modeling, and compliance guidance for startups and enterprises.
Recent Work
A selection of audits and security engagements
DeFi Lending Protocol
Chain: Ethereum
Web3 Exchange Platform
Chain: Web App + API
NFT Marketplace
Chain: Polygon
Meet the Founder
I write Solidity code for a living and spend the rest of my time breaking it. That combination is what makes this work: I know how protocols are built, so I know exactly where they fall apart.
SpectraSec Labs is my one-person shop — no junior analysts rubber-stamping audits, no offshore outsourcing. You get me on every engagement, which means you get someone who actually cares whether your protocol survives mainnet.
Attacker Mindset
I don't run scanners and call it a day. I think like someone trying to drain your protocol — because that's the only kind of audit that actually matters.
I Build and Break
I write smart contracts myself. That means when I review yours, I catch the subtle logic bugs that automated tools and checklist auditors walk right past.
Reports You Can Actually Use
Every finding comes with a working PoC, clear business impact, and a fix. Not a wall of CVE numbers with no context.
Security Insights
Research, writeups, and vulnerability disclosures
Reentrancy Attacks in 2024: Are Protocols Still Vulnerable?
Top 5 Pentesting Techniques for Web3 Applications
How We Found a Critical Flash Loan Vulnerability in a $40M Protocol
Let's Talk
Got a protocol going to mainnet? A bug that's been bugging you? Want to know if your smart contracts are actually safe? Drop me a message.
Contact Information
Security Newsletter
Get weekly Web3 vulnerability alerts and security tips.