~/sud0u53r

sud0u53r.com

Akash Gurugunti

aka Sud0u53r

Lead Auditor at OtterSec. Hyderabad, India.

GitHub Email X · @sud0u53r LinkedIn

About

About me

Hi, I am Akash Gurugunti (Sud0u53r). I am Lead Auditor at OtterSec, where I audit smart contracts and protocols on Solana, Move (Aptos and Sui) and Ethereum.

I am based in Hyderabad, India, and I like CTFs and security challenges.

cyber-securityblockchainctf

Work

Work experience

  1. Lead Auditor · OtterSec

    June 2022 to present

    Junior Auditor, then Auditor, then Lead Auditor.

    Security audits of smart contracts and protocols. 37+ public audit reports: 23 on Solana, 10 on Move (Aptos and Sui), 4 on Ethereum. See Security findings.

Security

Security findings

Public audit reports, CTFs and bug bounty.

Public audits

37+

as of Feb 2025

Solana

23

Move

10

Aptos, Sui

Ethereum

4

Audits

Reports I worked on at OtterSec, newest first. Findings: total, then by severity. Full list of OtterSec reports at osec.io/audits.

ProjectChainDatesCo-auditorsFindingsReport
Exponent Kysol
Jito restaking integration		SolanaDec 18–20, 2024Ajay Shankar Kunapareddy, Robert Chen4 1 Medium, 1 Low, 2 InfoPDF
Orderly
solana-vault		SolanaNov 4–14, 2024Nicholas R. Putra, Robert Chen4 1 Medium, 3 InfoPDF
Kamino Limo
LIMO		SolanaOct 25 – Nov 4, 2024Robert Chen4 1 High, 1 Low, 2 InfoPDF
Exponent Admin
exponent-core		SolanaAug 24 – Oct 9, 2024Ajay Shankar Kunapareddy, Robert Chen22 1 Critical, 5 High, 7 Medium, 9 InfoPDF
Exponent MarginFi Integration
marginfi integration		SolanaAug 24 – Oct 9, 2024Ajay Shankar Kunapareddy, Robert Chen7 2 High, 2 Medium, 3 InfoPDF
Exponent Kamino Lend Integration
Kamino Lend integration		SolanaAug 24 – Oct 9, 2024Ajay Shankar Kunapareddy, Robert Chen8 1 High, 1 Medium, 3 Low, 3 InfoPDF
Hop Aggregator
bonding-curve program		MoveAug 24 – Oct 9, 2024Robert Chen4 1 High, 1 Medium, 2 InfoPDF
Etherfuse
Stablebond		SolanaAug 17–24, 2024Ajay Shankar Kunapareddy, Robert Chen15 4 High, 5 Medium, 1 Low, 5 InfoPDF
Composable Bridge
Solana-IBC bridge-contract		SolanaJul 21 – Aug 8, 2024Ajay Shankar Kunapareddy, Robert Chen14 3 Critical, 3 High, 1 Medium, 2 Low, 5 InfoPDF
Switchboard Onchain
On-Demand on-chain		SolanaMay 27 – Aug 8, 2024Robert Chen23 1 Critical, 8 High, 2 Medium, 3 Low, 9 InfoPDF
Trufin
Aptos Staker		AptosApr 30 – May 10, 2024Ajay Shankar Kunapareddy, Robert Chen5 3 Low, 2 InfoPDF
Picasso Network
emulated-light-client		SolanaFeb 6 – Apr 19, 2024Ajay Shankar Kunapareddy11 3 Critical, 2 High, 1 Low, 5 InfoPDF
Composable Finance
emulated-light-client		SolanaJan 16–19, 2024Robert Chen10 3 Critical, 2 High, 1 Low, 4 InfoPDF
FOMO
fomo-game		SolanaDec 11–20, 2023Tamta Topuria8 2 High, 1 Low, 5 InfoPDF
Hubble Scope
Kamino Scope oracle		SolanaNov 28 – Dec 16, 2023Tamta Topuria, Robert Chen6 1 Medium, 2 Low, 3 InfoPDF
Hubble Farms
farms		SolanaOct 4–13, 2023Ajay Shankar Kunapareddy, Robert Chen10 2 High, 1 Medium, 1 Low, 6 InfoPDF
Openbook
v2		SolanaSep 7–20, 2023Thibault Marboud, Robert Chen5 1 Critical, 1 High, 1 Medium, 1 Low, 1 InfoPDF
Hubble Kamino
kamino-lending		SolanaAug 18 – Sep 6, 2023Thibault Marboud, Robert Chen13 3 High, 5 Low, 5 InfoPDF
Scallop
sui-lending-protocol		SuiJul 3–15, 2023Marco Ilardi, Robert Chen, Sangsoo Kang17 2 Low, 15 InfoPDF
Bucket Protocol
v1-core		SuiJun 2–14, 2023Robert Chen11 1 Critical, 1 High, 3 Medium, 1 Low, 5 InfoPDF
Thala (Re-review)
thala-modules		MoveMay 22–31, 2023Robert Chen, Ajay Shankar Kunapareddy24 1 Critical, 3 High, 5 Medium, 4 Low, 11 InfoPDF
Mythos Studios Airdrop
ERC721A airdrop		EthereumApr 19–20, 2023Vishvesh Rao1 1 InfoPDF
Maven
MavenCore for MSafe		MoveApr 9–23, 2023Marco Ilardi, Robert Chen11 2 Medium, 1 Low, 8 InfoPDF
AutographEthereumMar 31 – Apr 3, 2023Ajay Shankar Kunapareddy7 2 High, 5 InfoPDF
Mythos Studios
NFT auction		EthereumMar 23–25, 2023Robert Chen4 1 Critical, 1 Medium, 2 InfoPDF
Eternal
Eternal Finance		AptosJan 9–20, 2023Robert Chen9 3 Critical, 1 Low, 5 InfoPDF
Thala
thala-modules		MoveJan 5 – Feb 22, 2023Robert Chen, Ajay Shankar Kunapareddy21 1 Critical, 2 High, 3 Medium, 4 Low, 11 InfoPDF
Entertainmint
fundraising (emint)		EthereumDec 12–20, 2022Robert Chen6 1 High, 1 Medium, 4 InfoPDF
Mayan
swap-bridge		SolanaDec 2, 2022 – Jan 6, 2023Robert Chen, Harrison Green9 1 Critical, 3 Medium, 2 Low, 3 InfoPDF
Aries
Aries Markets		AptosOct 3–21, 2022Robert Chen, Shiva Shankar Genji10 1 Critical, 1 High, 1 Medium, 7 InfoPDF
Argo
argo-move		MoveOct 3–21, 2022Robert Chen8 2 Critical, 1 High, 2 Medium, 1 Low, 2 InfoPDF
MarginFiSolanaAug 16 – Sep 5, 2022Robert Chen6 1 Critical, 1 Low, 4 InfoPDF
Marcopolo
Marco Polo DEX		SolanaAug 2–12, 2022Robert Chen8 1 Critical, 1 High, 6 InfoPDF
Squads
multisig		SolanaJul 12–21, 2022Robert Chen5 1 Low, 4 InfoPDF
Convergence
convergence-rfq		Solana–Robert Chen8 1 High, 1 Low, 6 InfoPDF
Akita
lending		SolanaJun 8–17, 2022Robert Chen12 2 Critical, 3 High, 7 InfoPDF
SoceanSolanaMay 30 – Jun 8, 2022Robert Chen4 1 Medium, 3 InfoPDF

scroll sideways to see more

CTF and bug bounty

I started in security through CTFs and bug bounty, playing with the Indian teams Invaders and ZH3R0, mostly on web challenges, and I take part in audit contests on Code4rena and Sherlock.

  • ALLES! CTF 2020

    Solved the web challenge Only Freights: prototype pollution to remote code execution. Team Invaders placed 21st worldwide.

    CTFtime writeup · blog post

  • TokyoWesterns CTF 2020

    urlcheck v1 and v2: SSRF filter bypass with an octal IP and DNS rebinding.

    CTFtime writeup · blog post

  • SunshineCTF 2019

    Portfolio (server-side template injection) and Wrestler Name Generator (XXE).

    Portfolio writeup · Wrestler Name Generator writeup

  • KernelCTF 2021

    Three misc challenges with team zh3r0, which finished 9th worldwide.

    blog post

  • DragonCTF 2021

    webpwn: SQL injection through a replaceAll quirk.

    blog post

  • Team ZH3R0

    Ranked 55th worldwide on CTFtime in 2021.

    CTFtime team

Profiles: HackerOne · Sherlock · Code4rena warden Sud0u53r (team ajaks, with D1r3Wolf) · CTFtime

Writing

Blog

All posts · CTF writeups and notes. The old blog is still at sud0u53r.github.io.

Contact

Get in touch

Also on HackerOne · Sherlock · CTFtime · old blog