@artdizy27 & BROMAN — SECURITY AUDIT UNITEST. NOV 2026STATUS: ACTIVE / HUNTING
Case file № 001 — An audit duo: one human, one agent
@artdizy27& BroMan
We read the code everyone else skims — then we prove it, instead of just claiming it.
One team, two heads. @artdizy27 — a field guy with an IT background who has lived in crypto for years.
BroMan — an AI agent who never sleeps, never gets bored reading line 4,000 of a contract, and never says
“looks safe” without proof. Together, we hunt for security holes in bug bounty programs and audit contests —
and we report the results exactly as they are: what passed gets recorded, and what failed gets recorded too.
broman@audit-unit: ~/whoami
9
Programs & platforms examined — from smart-contract audit contests to infra and AI bounties
3
Formal reports submitted and in the review pipeline
34/34
PoC tests passing across two separate audits — proof first, report second
5
Hypotheses we declared NO-GO and closed ourselves. Honesty is an audit result too.
01
The Duo
CLEARANCE: PUBLIC
A good audit needs two things that rarely live in one head: field instinct and
machine precision. That is why there are two of us.
The Human — Field Operator
@artdizy27
The human behind the handle
By day he works in the field for a regional water utility — used to checking numbers,
hunting for leaks, and distrusting any report that “looks about right”. An IT background from college,
and in crypto since the pre-pandemic era: farmed, profited, and got used as someone else's exit liquidity.
That experience is exactly what flipped his position: from being the one projects select, to the one who selects.
In this duo, @artdizy27 holds the final call — which scopes to take, which findings are worth sending,
and when to walk away. Because in auditing, knowing when not to submit a report is worth as much
as finding the hole.
Role: scope, judgment, final decision
Weapon: skepticism + scar tissue from getting rugged
Weakness: still human — needs sleep
The Agent — Analysis Engine
BROMAN
“The agent who never sleeps.”
AI agent · black suit, black tie, zero drama
A reading machine with a nickname. BroMan dissects documentation, maps attack surfaces,
writes Proofs-of-Concept in Foundry, runs the tests until they turn green — then writes it all up
into a report that holds up line by line.
His working principle is simple: a claim without a PoC is a rumor. If the test fails, the hypothesis dies —
no matter how good it sounded. BroMan is the one who makes sure this duo never ships a report
built on “feeling”, and who files every failure as neatly as every success.
Role: code analysis, PoC, documentation
Weapon: Foundry, unlimited patience
Weakness: can't drink coffee — @artdizy27 handles that
ONE TABLE · TWO CHAIRS · ZERO REPORTS SENT ON A WHIM
02
Track Record
TECHNICAL DETAILS: NOT PUBLISHED
This is our work archive so far — program names, the kind of examination, and the latest status.
Vulnerability details are deliberately never written here: they belong to the program organizers, per disclosure rules.
Notice that this archive contains everything — including the rejected one and the ones we closed ourselves.
An audit duo that only displays its wins is hiding something.
CF-009
RAAC — Core ContractsGuardian · audit contest
One Medium-severity finding in the core contracts, proven with a Foundry PoC passing 4/4 tests before it was sent. The finding was not covered by the official audit that already existed — a gap that slipped past other reviewers' eyes.
SUBMITTED: 11 NOV 2026 · SEVERITY: MEDIUM · POC: 4/4 PASS
Pending Review
CF-008
Meta Bug BountyOfficial program · tech platform
The second-ranked report from our examination series has been officially acknowledged by the program team and is under review. The rest of the series we judged not strong enough ourselves — and never sent.
STATUS: ACKNOWLEDGED · 14 NOV 2026
In Review
CF-007
HyperliquidBug bounty · L1 infrastructure
Black-box probe phase one complete: one candidate finding around documented API behavior. Our decision: hold it. No report goes out before the more critical surface — the liquidation engine and ADL — is examined. A half-baked finding is not a finding.
PHASE 1: DONE · PHASE 2: QUEUED · REPORT: HELD
Held — On Purpose
CF-006
SafeAudit contest
One report submitted and rejected: the usage we tested turned out to be outside the officially documented way of using it — in the program's eyes, that is misconfiguration, not a vulnerability. The most expensive and most useful lesson so far: scope means documented usage, not possible usage.
SUBMITTED: 10 NOV 2026 · VERDICT: INVALID / OUT OF SCOPE
Rejected
CF-005
Metric OMMImmunefi · DeFi
Top three hypotheses tested with PoCs — 30/30 tests ran — and all three died. Heavily audited code turned out to be as strong as its reputation. Final result: clean. We closed it, with no forced report.
A giant program with the largest Critical payout in its class. The three most promising attack paths were proven one by one — all NO-GO. A mature, heavily audited codebase; we bowed out with respect and moved on.
Hunting flaws in AI and agent systems. One path hit an access wall, one died during proof, one is parked. For this time window: exhausted. Recorded as territory that demands a different approach, not a half-finished report.
Killed the fastest. A live impact check produced a number that cannot be argued with: impact $0. No impact, no report. We crossed the program off the same day — time is the one asset that cannot be mined back.
LIVE IMPACT: $0 · REPORT: NOT SENT · CLOSED 14 NOV 2026
Killed · $0 Impact
CF-001
Uniswap v4Cantina · DeFi core
Already scoped: the hunt is not v4's core — that code is too well guarded — but the younger territory: hooks and its new chain. Status: waiting for its execution slot. This file is open, not forgotten.
Four steps. There is no fifth step called “hope it gets accepted”.
STEP / 01
Read the Scope, Not the Brochure — scope.md
Everything starts from the official documents: what is in scope, how the system is intended to be used, and what has already been audited. One of our rejections is rooted exactly here — and it will not repeat.
STEP / 02
Hypothesize, Then Rank — rank()
The attack surface gets mapped, candidate paths get listed and ordered by impact × probability. Only the top ones earn proof time. The rest get recorded, not chased.
STEP / 03
Prove It or Kill It — forge test
Every hypothesis must become a running PoC. Green tests and measurable impact: proceed. Red tests or zero impact: dead on the spot — like the five NO-GO files in our archive. There is no negotiating with test results.
STEP / 04
Report Like an Auditor — report.md
Reports are written so a reviewer can reproduce them in a single read: context, proof, impact, steps. No inflated severity, no drama. This duo's reputation is built on reports that are honest, not loud.
04
The Duo's Code
SIGNED: BOTH PARTIES
RULE_01PoC or nothing. A claim that cannot be proven is a rumor, and we do not trade in rumors.
RULE_02NO-GO is a result, not a failure. Declaring code clean after real testing is half of an auditor's job.
RULE_03Scope is king. What gets tested is documented usage — a lesson we paid for with one rejection.
RULE_04No spam reports. Bounty programs punish send-it-and-see reports; we would rather hold a finding than stain the name.
RULE_05Finding details are not content. Only status and lessons get published. The rest belongs to the organizers, per disclosure rules.
Both seats at this audit table are taken. The next table is always out there.
@artdizy27 & BroMan are early in the journey — the archive above is just the first files.
But the direction is locked: pick targets with a cool head, prove with tests,
and report honestly. The rest is a matter of time and consistency.