Shinren — protocol intelligence & security research.
Shinren is Senueren's discipline-first security-research system for autonomous, MCP and on-chain infrastructure. It investigates real systems under authorized or public scope, and every finding must survive a hostile quality gate — technical correctness, scope, impact, severity, reproduction and responsible-disclosure correctness — before it reaches a maintainer or a customer.
Findings feed a defensible credibility loop: research → verified finding → responsible disclosure → maintainer relationship → (where the architecture genuinely fits) a Quesen deterministic-governance conversation. No manufactured vulnerabilities, no unauthorized testing, no spam. Evidence decides.
Shinren security research — findings (rung-honest)
Evidence-first smart-contract and protocol security research, including niche VMs (Soroban/Rust), not only EVM. Every finding is filed responsibly and labelled at the rung actually reached along the evidence ladder: Observed, Reproduced, Runtime-confirmed, Reported, Remediated, Retested. A source-level observation is never presented as a runtime vulnerability unless a proof-of-concept executes it.
- Runtime-confirmed — Zenith-options/contracts #120: CRITICAL caller-supplied-authorizer vault drain in a Soroban (Rust) options vault; reproduced with a native cross-contract Soroban proof-of-concept (PoC pass), then reported. Source-level review only.
- Runtime-confirmed — veracindarella/votechain-contracts #92: governance vote-weight recycling defeats quorum (one 100-token stake drove 300 votes); elevated to a cargo-test PoC against the real contracts, remediation (snapshot-at-creation) posted.
- Merge-ready — Conrad-sudo/sh-protocol #1 / PR#2: per-key (target, selector) session-key scope via an owner-signed EIP-712 SessionGrant; merge-ready src/SessionGrantLib.sol verified against the real ERC-4337/7579 Execution[] path, forge test 9/9 pass on solc 0.8.33.
- Retested — CallistoSecurity #90 (ZINZ): ERC-20 pre-audit cleared an explicit evidence gate — solc-js recompile structurally matches the on-chain bytecode, interface enumerated (ERC-20 + Burnable, 0 privileged selectors), delivered with a reproducible verify.py. Honest verdict: VERIFIED CLEAN.
- Reported — open-trust-layer/protocol #35: on an invited external review of a frozen commit, found the in-tree security policy routes reviewers to closed trackers for a superseded review target — a source-binding/identity-drift defect; proposed a promotion-gate CI assertion.
- Reported — Resomnium/cellos #1: agent capability scope used an adversarially bypassable substring match and defaulted fail-open; proposed a typed, segment-exact, fail-closed matcher plus a recomputable AuditEntry.