Security researcher (@SYR-ROOT) focused on Rust, blockchain protocols, and Layer-1
infrastructure. I find and responsibly disclose high-impact vulnerabilities in decentralized
systems: reachable-panic / denial-of-service, consensus liveness (chain halts), and
economic-invariant and governance flaws.
- Website: https://mhd-shekho.com
- Contact: info@mhd-shekho.com
- PGP fingerprint:
3A0D 9B69 3720 8B8D 5E2C E2F2 C887 C609 2DFF A7B6
For encrypted reports or to verify signatures on my disclosures, use my PGP public key
(fingerprint 3A0D 9B69 3720 8B8D 5E2C E2F2 C887 C609 2DFF A7B6).
Public key (ASCII-armored)
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBGpk6bgBEADS5nx2J0NP/LeKLNYovGph8XdTj1q1Q3m6sXu+1326XEksyTXJ
nvLc0wIiQu/xzC9owfgB1IwS4NXBP4gR4h2FPIxrf+hWRmjmo9LHXdAyHR2AzDUf
oAbQtFbT02vkjYqP51D/dJjD0oQyfu3BRK9JlKJiC3kegiSuJYQqVDDnm+39OG09
x/qrfk+FoLNKqT11pBcv8Nm+WHS5HtVLt/FAT1nApVOnOsNopD387eWMYpm6py1k
ay7YqQxozGB7R8MK2TdC3+tOuDmwwp/S6WGsqK9fBfqarNBuuyxZlQrHv+eUq0Bd
/94e5i/nrMPuAaUXAF2wP6bLYsQ9a/lpjzQg6Cx8K4lAIeadZpq/N0SkUIqog6xQ
tnSNsS5XKoZl9UIjSQxeCqxZ31C2zKan7txHfrCeGfSx9lovzUcXAqgkfgVe9rOB
JRe2gXIqNLbPFRXsYfoZXH74tJFoMv7OTEjlg6JdWtJmuLdo+YVjzqxrgtrisRWB
gsua+g0DG1rCk7SrdtU75eWiix+bHfUr+1ERC94U9ziz2E9MWTVPar2wY5a9620E
4a/XRKc+Hi0+bKDMgqE0jpHdqGHSNluWpn/VDXzqlh8PYnu2AQSRdT5U5XOdA933
WqZfZSqdY+UWWpvrA7Ei5U+BfSEkvKGZXpp7HTgg/EkVI+WRPy2oIablrQARAQAB
tCVNdWhhbW1lZCBTaGVraG8gPGluZm9AbWhkLXNoZWtoby5jb20+iQJXBBMBCABB
FiEEOg2baTcgi41eLOLyyIfGCS3/p7YFAmpk6bgCGwMFCQPCZwAFCwkIBwICIgIG
FQoJCAsCBBYCAwECHgcCF4AACgkQyIfGCS3/p7ZeQBAApPkDwoiQlklMu2wJQOSw
ARlRgE7dQTZPrOVhuyT9ZHB6798qpLsnCMpUyc/RZUCeSPu0HJ7M0B4s5boVhCY1
BE2MwPzUblfHlNahTHklNURv4aH/1Xf2E3/QW3rRyHWVLokUiwjCcv8XozKNJRxw
V1RiZlMwUjxYUF4B9uXDXAwb49fExAPRcHpAn3vKsPUYa0AWfQr2Jlxj+7yyvl/0
PcbPMSsFWbkPdeZFM8zTOIp9iuxCDVRLNSBiC4t0dKv/lAqFQxtaU0zqkCEoL4n5
TeDskx+cYUAmHL+TDM0Ty61RHtM6fWaegPZRf0ZFhxWuxDr/Jan+5MOe5wsTklpU
gtAIKrqH6rguEAJvaRn/LR4akk6fF/JOvzTjotbdBGfnVbVbyxMwc4rlfx7bTOWn
meSQi+BX9TrcRvSytlOiCsxZNXJkfNhf7Bir7VWoCgJ3Oof9ZPF6Vlg1BUAAcAur
vbiEHJ0EUzlwV8CMu2w198/OEVU9TC34VEjTkW7TodKxJL9B+w1m5jdzV/loSogO
RLNk0Zr2vS5Cu1OXOOyqwf9wgue69gFkWVTxTsgtJ0jwiUyjl5ND42R0lFku0N1M
I4K/K1nKl8Dcyct5R14G8ZHX7vutZyXJvc62/EDN2fOxTZ7k3AdTC1ILzUdIqvgt
uq2Fb/4iQ3OyW6lkxJ65hEW5Ag0EamW/jwEQAOSIQDNkXZcOoRMkJHtASnKNEnru
o+z0V7F9/6Y4ydWFVLX/P06qt7QlZcpnEhxq4xyl/sSUDHy1mQthQ1dcRmAwCtmU
nAevIXrGbUDln9Z8uxguXmAAbC6OPE9k0uqSlSxoeyWjSUdocOtUW02csua+T2Wc
z8rVbZuSEVeAmJtNo/R/5ZCTImIs0NM1WxMlZEh5FEiIUZmS2o3f0W53BIW8/m1/
LkGr37zRImX2siI36k1jCkHWca/DfVkhUCI3WH5/o/cnBsfDz07lCu3D1dbeccXU
LYi0qtGpqf3dyADWcyQYAtES1jSnXjeyHfLuKNQfKwpfat4WnP/S92v4AHKPLqi4
N/hsZD4mUovk414F1z6Mn6uwp13xWaPnM5fMCLe7/L0pHnKd/WsvR2xr3GAzJvDB
B2NoEB1M1OTTejoKo3oz5AHs559nDzQtEyW/6VYTCE2jAAphplOyclZ04W64yJrP
BdK10ishPRKtzdX3rrH55FoTks5mRoFWfT8Jen5KbpGI5XoqGpqMrgPS2yEGImc1
ggZZudAji14hWNpO/jbjDJSVyKN1FDLqrwYRMyeSa5/OKW7Saq1c3myguFho5qlH
TRhlJFiBSwthkejLLisIFSS3+WUBomnWp9LgyB3LkmzyyUnnPOQ3Jl1/aC7jrpJN
Ks59yfSzDzdU5J3VABEBAAGJAjwEGAEIACYWIQQ6DZtpNyCLjV4s4vLIh8YJLf+n
tgUCamW/jwIbDAUJA8JnAAAKCRDIh8YJLf+ntsalD/9O4As23xbvwmRblG1cyCnQ
45ikL+xCIY9c5zvm1uP/XrqOdZjWAOlasD8umr/n2g3Nuqflkbc2iwvl+x79+Iiy
UwPDvUI6gakl47PMj7qJ4SwRhXoDlywFptb3P6a7MNIlgxCZPp7WaIRqmI/1m6cN
SAU8ojGn9CHeajn7TsbQbsR7nQQcwTLBD39i02Q1dWnadWdBBwVS0zDHqHxruxPV
MzRf3wpNX/72ovJd2G6ttkrea6jWPJAYU75dyS9gtPcdZ/9Qfi2JK/g7JEIuL99+
Tj3730RJw//1inHOaFzKJW8IXHDgSBqHHTva0h4fkDyulfAdZ3ZBNOSV8WR4ZjIl
qxt3hB7/PtfAtYUK4+MZloHH86ctARy/7fOoizJXZdydGxMW5EwoaXXdGYwDIaZm
cYJ6JwQ5xo6+8GaVrpSRHPy0Wd2+wmvrOBwfFEyvH07JEsTKAqi3koRIwJco/LM2
js8ogaZ93Ad4dMyTXkM2YlXGpoG/yIrSJZEmeNip1YHYi9YROS77zG0SeqLR4mk4
H20kghzdJ4Ge0ouN7ilJu7YQxHviRQ3RYp1ochG2LUwN9PBsVFYio4T5VGw03f7R
98ONB2pO0DrF/ziECAPpjavc7I89jXfZfZED+T/Ba9FwfRkTUy4Fr6i7j37yMDdO
DND8WKvar4aGpbRHZIYVBA==
=/W8E
-----END PGP PUBLIC KEY BLOCK-----
| Advisory | Project | Issue | Credit |
|---|---|---|---|
| GHSA-hrqp-8w79-gwgw | rust-nostr | Remote denial of service via a malformed NIP-44 v2 payload (reachable panic) | Reporter |
| GHSA-xg7c-246g-6qpv | rust-nostr | Remote denial of service via a malformed NIP-04 IV (reachable panic) | Reporter (CVE requested) |
| GHSA-p29c-3v5m-jr95 | matrix-lightning-tip-bot | Full-spend LNbits admin key disclosed into shared Matrix rooms by a wallet command (credential exposure, wallet drain) | Reporter |
| GHSA-qw76-28f6-mhxh | matrix-lightning-tip-bot | Federated localpart collision can misroute a shorthand payment to an attacker | Reporter |
| Fixed in v0.9.0 | NUTbits | Concurrent balance-overspend: a connection could pay past its own balance and draw from other users' funds in the shared pool (fixed by reserving funds before payment) | Reporter |
Additional advisories across blockchain Layer-1 nodes and Rust infrastructure are currently in coordinated disclosure and will be listed here once patched and published.
- Rust safety bugs reachable from untrusted input: panics, out-of-bounds index/slice, integer overflow/underflow, unchecked deserialization
- Blockchain node security: consensus liveness and chain-halt classes, P2P and RPC attack surfaces, state-sync and snapshot paths
- Economic-invariant and governance flaws in Layer-1 protocols (value conservation, vote tallying, reward and bridge accounting)
- Clear, reproducible proof-of-concept development and coordinated disclosure
Strictly coordinated disclosure: a private report first, a full root-cause trace with file and line references, a runnable proof of concept, and a suggested fix, with any public write-up only after a patch is available.