kemmio
Cofounder/CTO - Hexens
Motivation
Arbitrum is at an inflection point. The Stylus upgrade significantly expands the smart contract execution surface beyond Solidity into Rust and C++, introducing vulnerability classes that most existing council members and auditors have limited exposure to. My background in low-level systems security, VM internals, vulnerability research and reverse engineering is directly relevant to evaluating risks at this layer.
Separately, having built Glider, a purpose-built tool for real-time smart contract vulnerability scanning that can accelerate blast radius assessment in an emergency scenario. This has already been demonstrated in production during the Thirdweb, Balancer and SOLC bug incidents.
My approval on the Arbitrum Audit Program means this candidacy is part of a broader, longer-term commitment to the ecosystem.
Experience
The Arbitrum Security Council’s core function is emergency response. Due to the nature of our tools (and not only), I also have direct, hands-on experience in one of the biggest cases, like: Thirdweb hack: Cooperated with chains and used Glider to determine the blast radius and help identify all affected projects Balancer hack: scanned the whole integrated chains (using the same tools) to identify affected contracts and proactively notified projects before they were exploited within 15 minutes after the hack became public. Solidity bug case - again, Glider was used to search for affected projects, allowing us to proactively notify them before they were exploited (more in the section below). Relevant Credentials & Affiliations Member of the wider Security Alliance (SEAL) community. Member of the Polygon and Bitcoin security councils Hexens is an approved auditor on the Arbitrum Audit Program Competitive Security Background - I am a winner of over 20 international cybersecurity competitions (CTFs), both solo and as a member of the MSLC team.
Skills
Cybersecurity
My primary areas of expertise are VM and low-level component security, EVM and blockchain internals, zero-knowledge proof auditing, reverse engineering, and vulnerability research. Highlights include: Discovered a Solidity compiler bug: TSTORE poison - publicly disclosed at hexens.io/research/solidity-compiler-bug-tstore-poison. This is the first reported maximal severity finding in Solidity since 2016. Built security and data research tools for smart contracts (we also run an Ethereum Foundation grant-funded contest for it), which have been used in live incident response scenarios Pioneered security reviews for novel technologies, defining the methodologies, such as zero-knowledge execution environment security, including the first-ever zkEVM and zkVM audits for Polygon and RISC0.
Projects
Member of the wider Security Alliance (SEAL) community. Member of the Polygon and Bitcoin security councils. Hexens is an approved auditor on the Arbitrum Audit Program. I am not aware of any conflicts of interest that would impair my ability to act in the best interests of the ArbitrumDAO as a Security Council member. If any arise during my tenure, I will disclose them promptly and recuse myself where appropriate.