Ігор

25.05.2026, 16:32 Ihor Zvagolsky — Software Engineer & Security Researcher

Ihor Zvagolsky
SOFTWARE ENGINEER · SECURITY RESEARCHER
Ukraine · [open contact info](look above in the "contact info" section) · Telegram: @Ypeels · HackerOne · Immunefi · Cantina

SUMMARY

Software Engineer, 6+ years in production. I have shipped products in defense, cloud PaaS, e-commerce and iGaming,
and I currently work on the web side of Ukraine's gas-transportation infrastructure. My day-to-day stack is React and
Vue 3 with TypeScript, but I am just as comfortable picking up the backend when a feature needs it. On the side I do
bug-bounty work on HackerOne, Immunefi and Cantina — 35+ accepted findings (2 Critical, 9 High) on DeFi
protocols and web platforms, every one shipped with a working PoC and a real-money impact estimate.

E XPERIENCE

Naftogaz Group — National Gas Operator of Ukraine 2024 — Present

Software Engineer
I work on the web tools used by dispatchers, operators and administrators of the underground gas storage and gas-
transportation network. Most of what I do is React 19 with TypeScript, but I also handle the build, the Docker image, the
design tokens and the docs that go with each release.
Built the role-based portals (ADM / DIS-S / OPR) — two layouts, route guards (AuthGuard, ProtectedRoute,
RoleRedirect), and an RTK Query base that handles tokens and tag-based cache invalidation.
A lot of the work is editable data-grids — AG Grid, react-data-grid, MUI X DataGrid. I wrote the reusable hooks behind
them (useFormTableData, useFormTableChanges, useChangedRows) that handle batch edits, optimistic updates,
validation and undo.
Shipped the screens for gas-extraction reporting, well shutdowns, KPI indicators, equipment catalogs and configurable
reports, plus a tree navigation over the equipment hierarchy (react-arborist) and an Excel export on top of xlsx.
Wrote a small JSON-driven config editor on jsoneditor + mathjs so analysts can describe computed indicators
without waiting for a redeploy.
Brought Jest + React Testing Library into the project and covered the parts that hurt the most when they break —
hooks, reducers, form schemas.
Set up i18next (Ukrainian first, English as fallback), a Tailwind v4 light / dark / system theme on a tweaked HeroUI
palette.
Packaged the apps in a multi-stage Docker image behind nginx, with runtime config injection per environment. Also
wrote the architecture and auth-model docs that the team now uses.
Stack: React 19, TypeScript, Redux Toolkit (RTK Query), React Router 7, MUI v6 / MUI X, HeroUI, Tailwind 4, AG Grid, react-data-
grid, Formik + Yup, i18next, jsoneditor, mathjs, dayjs, Jest + RTL, Vite, Docker, nginx.

Gaming Platform — Online Gambling / iGaming 2022 — 2025

Senior Frontend Developer
Senior on the frontend team of a Vue 3 gambling product — live tables, payments, the regulator-facing flows. Five
frontend engineers reported to me on day-to-day work.
Rebuilt the app on Vue 3 Composition API with a Vuex store and TypeScript across the codebase.
Wrote the real-time game layer over WebSocket — kept input-to-render under 100 ms on live tables, added a
reconnect / state-replay path so a flaky mobile connection does not lose the round.
Built the payments and KYC/AML flows, integrated several payment providers behind the same checkout, and made
sure the screens passed the regulator review.
Pushed the PWA work (installable, offline shell, push notifications) and a performance round that cut ~50% of the old
tech debt. App held 99.9% uptime through the period.
Mentored the team — pairings, RFC reviews, an onboarding playbook for new hires.
Stack: Vue 3, Composition API, Vuex, TypeScript, WebSocket, PWA, Webpack / Vite.

file:///c%3A/Users/sleepy/Desktop/Ihor_Zvagolsky_Resume.html 1/5
25.05.2026, 16:32 Ihor Zvagolsky — Software Engineer & Security Researcher

E-commerce Platform — Multi-Vendor Marketplace 2020 — 2022

Middle Frontend Developer
Worked on a multi-vendor marketplace — both the storefront and the admin panel — that grew to 10,000+ users
while I was on the team.
Wrote the customer-facing part in Vue.js + Vuex + TypeScript: catalog, cart, checkout, order tracking. The admin
panel sat on Vuero / Vuely with Vuetify and Bulma.
Integrated payments across several providers, plus the shipping and analytics APIs, and added a small theming layer so
vendors could brand their storefronts.
Moved the build off the old setup to Vite, route-split the bundles and lazy-loaded the heavy widgets. Load time
dropped about 60% and PageSpeed landed in the 95+ range.
Wrote the shared HTTP layer on Axios interceptors (auth refresh, error normalization, retry) that both apps ended up
using.
Stack: Vue.js, Vuex, TypeScript, Axios, Vite, Vuetify, Bulma, Vuero / Vuely.

Cloud Platform — Heroku-like PaaS 2020

Full-Stack Developer
Full-stack work on a Heroku-like PaaS product — the customer dashboard on one side, the GraphQL API powering it on
the other.
Built the frontend in React + Redux + Ant Design, including the dashboard for app deployments, resource usage and
billing.
Wrote the GraphQL API on Node.js + Express and split the repo into Lerna packages along the microservice
boundaries.
Glued in the third-party pieces (auth, billing, logs, metrics) and reworked the deploy pipeline so a release went out
roughly 40% faster.
Stack: React, Redux, Ant Design, GraphQL, Node.js, Express.js, Lerna.

Defense Systems — "Delta" (Automated Control System for the Armed Forces of Ukraine) 2019
Frontend Developer
Frontend work on "Delta", the situational-awareness and battle-management system used by the Armed Forces of
Ukraine. Mission-critical UI with strict reliability and security expectations.
Built the control and monitoring screens in React + MobX + Styled Components, and tuned the Webpack build for a
restricted environment with no public CDNs.
Wrote the real-time dashboards — tactical map overlays, streaming telemetry, live unit status.
Put together a shared component library that other modules of the system picked up later, which cut a lot of the time
spent on new screens.
Worked under defense-grade security review; the components I shipped ended up in production use during operations.
Stack: React, MobX, Styled Components, Webpack.

file:///c%3A/Users/sleepy/Desktop/Ihor_Zvagolsky_Resume.html 2/5
25.05.2026, 16:32 Ihor Zvagolsky — Software Engineer & Security Researcher

Independent Security Researcher — Bug Bounty 2024 — Present

DeFi Smart Contracts · Web Application Security
I work bounty programs on HackerOne, Immunefi and Cantina in my own time. The flow is usually the same: recon, then
manual code review, then a Foundry PoC that puts a dollar number on the bug. Most of my findings sit around ERC-
4626 vaults, Compound V2 / Aave V3 forks and lending-protocol math, with a steady second track on web — GraphQL
and REST enumeration, CORS / SSRF, exposed S3 buckets and CI/CD supply chain.

15+ 35+ 2 9 15
PROGRAMS FINDINGS CRITICAL HIGH MEDIUM

CRITICAL First-Depositor Exchange-Rate Inflation Attack — BENQI (Immunefi, Avalanche)
The classic Compound V2 share-inflation bug (around $32M lost historically across Hundred, Sonne, Onyx and Midas) was
still sitting in a live Avalanche market. I wrote a Foundry fork test where five victims lose 150 tokens to the attacker in a
single transaction, and recommended the OpenZeppelin ERC-4626 virtual-offset fix.

CRITICAL Bad Debt at CF = 98% — Missing CF × LI < 1 Invariant — Flux Finance / Ondo (Immunefi)
Flux raised Compound V2's collateral-factor cap from 90% to 98% for tokenized RWA but never added the CF × LI < 1
invariant. The math means any OUSG drop above 0.01% guarantees bad debt. A Foundry mainnet fork test put the loss at
$166–$625 per 100 OUSG position on a ~$38.5M-TVL market.

HIGH Orphaned Vesting Gains — Yield Theft — Seven Seas / Boring Vault (Immunefi)
The vault forgets to clear vestingGains when all shares get redeemed mid-vesting. The next depositor enters at a fair
share price, but totalAssets() still includes the orphaned gains, so they can withdraw at a profit. Two Foundry tests
(one for front/back-run, one for same-user withdraw + redeposit). On a 100 ETH deposit the attacker walks away with
about 8.57 ETH.

HIGH Bad-Debt Spiral via Liquidation Bonus + Zero-Fee Flash Loans — Spark / SparkLend (Immunefi)
For positions that are already deeply underwater (HF < 0.9), partial liquidations actually push the health factor lower
instead of bringing it back up. Pair that with SparkLend's 0% flash-loan premium and the attack runs with no capital. Eight
passing Foundry fork tests on mainnet. At protocol scale (about $1.6B TVL) the bad debt lands somewhere between
$3.2M and $30.8M depending on how hard the market crashes.

HIGH Arbitrary-Origin CORS Reflection with Credentials — Playtika (HackerOne)
octopus.playtika.com reflects whatever Origin you send it and pairs that with Allow-Credentials: true. My PoC
uses a sandboxed iframe with a null origin, so the attacker does not even need their own domain. From there: cross-origin
reads of authenticated employee campaign data and a writable POST against the events endpoint.

HIGH GraphQL Schema Leak + CAPTCHA Bypass + Config Exposure — Twilio SendGrid (HackerOne)
Five issues that chain together on the staging GraphQL console. The schema is readable via field-suggestion errors
(including OAuth credentials inside CreateEventWebhookInput). Both Turnstile and reCAPTCHA on staging use the
public test sitekeys, which always pass. And api_config.js leaks Auth0, Sift, Segment, Amplitude and Zuora keys.
Together they make automated credential stuffing trivial.

MEDIUM Blind SSRF via OAuth Token URL (GraphQL) — Twilio SendGrid (HackerOne)
The createEventWebhook mutation takes any oauthTokenUrl you give it. When a webhook fires, the SendGrid backend
(AWS EC2, us-east-1) sends client_id and client_secret in both the body and a Basic Auth header to whatever URL
you pointed at. Response timing also gives a blind internal port scan.

MEDIUM Sanctions Bypass via ERC-4626 Functions — Inverse Finance / Kiln OmniVault (Cantina)
The ERC-20 side (transfer / transferFrom) checks the OFAC BlockList, but the ERC-4626 entry points (deposit, mint,
withdraw, redeem) are missing the same notBlocked(receiver) guard. On a $600M+ TVL institutional vault, that lets
value route to a sanctioned address through the vault itself.

file:///c%3A/Users/sleepy/Desktop/Ihor_Zvagolsky_Resume.html 3/5
25.05.2026, 16:32 Ihor Zvagolsky — Software Engineer & Security Researcher

MEDIUM Unpinned GitHub Actions — Maven Central Supply-Chain Risk — Playtika OSS (HackerOne)
Three of the public Playtika OSS repos (including testcontainers-spring-boot, 3.2k stars) pinned actions-js/push to
@master inside their Maven Central release workflows. If that action ever got compromised it would have walked away
with the OSSRH credentials, the GPG signing keys and the RELEASE_PAT — enough to publish a backdoored package
under com.playtika.*.

A few more worth mentioning: two public S3 buckets on Banco Plata (the Vault PKI Root CA on one, 766 internal financial
documents on the other); WAF-only XSS and SQLi on CLEAR's KYC platform; missing security headers on Anduril and CLEAR; a
dev environment and a Meticulous recording token left exposed on Superbet; NetScaler VPN cookies without HttpOnly /
Secure; and PII leaking through GET parameters on Platacard that ended up indexed by urlscan.io.

PROGRAM PLATFORM SCOPE FINDINGS

BENQI Immunefi Avalanche lending (Compound V2 fork) 2 (Critical)

Flux Finance / Ondo Immunefi Tokenized-RWA lending 1 (Critical)

Spark / Sky / MakerDAO Immunefi SparkLend (Aave V3 fork), sDAI, sUSDS 5

Seven Seas / Boring Vault Immunefi ERC-4626 vault, yield vesting 1 (High)

Inverse Finance (Kiln) Cantina OmniVault, AAVE/Compound/Morpho connectors 1

Twilio SendGrid HackerOne GraphQL API, staging, event webhooks 2 (High)

Playtika HackerOne *.playtika.com, PlaytikaOSS, CI/CD 2 (High)

CLEAR HackerOne KYC / identity verification platform 3 (High)

Banco Plata / Platacard HackerOne Mexican neobank — API, S3, mobile 9

Bullish HackerOne Crypto exchange, trading API, options 4

Superbet HackerOne Sports-betting platform 2 (High)

NetScaler Gateway HackerOne Citrix VPN (NS14.1) cookie security 2

Anduril Industries HackerOne Defense-tech, AWS/CloudFront 1

TECHNICAL SKILLS

Languages TypeScript JavaScript (ES6+) HTML5 CSS3 / SCSS Solidity Python

Frontend Frameworks React 19 Vue.js 2 / 3 (Composition API) React Router 7 PWA WebSocket / real-time

State Management Redux Toolkit / RTK Query Redux Vuex MobX Reselect Immer

UI / Styling MUI v6 / MUI X HeroUI Tailwind CSS 4 Ant Design Vuetify Bulma Styled Components

Framer Motion

Data Grids & Forms AG Grid (Enterprise) react-data-grid MUI X DataGrid Formik Yup i18next

Backend / API Node.js Express.js GraphQL RESTful APIs Axios

Testing & Quality Jest React Testing Library ts-jest ESLint (typed) TypeScript strict

Build & Infra Vite Webpack Lerna (monorepo) Docker (multi-stage) nginx pnpm / npm Git CI/CD

Networks & Systems TCP/IP · OSI HTTP/HTTPS DNS Linux Windows macOS

Smart-Contract Solidity Foundry (forge / fork tests / fuzz) Hardhat Slither ERC-4626 vaults Compound V2/V3
Security Aave V3 MakerDAO / Spark MetaMorpho Uniswap Economic / invariant analysis

Web AppSec Burp Suite Pro Nuclei ffuf httpx GraphQL enumeration CORS / SSRF / XSS / SQLi

OAuth / JWT review WAF bypass analysis

Recon & Cloud Subfinder / Amass crt.sh / CT logs GAU / Wayback / urlscan.io Katana

LinkFinder + custom JS analysis AWS S3 enumeration CloudFront fingerprinting

Networks Ethereum Avalanche Hedera

file:///c%3A/Users/sleepy/Desktop/Ihor_Zvagolsky_Resume.html 4/5
25.05.2026, 16:32 Ihor Zvagolsky — Software Engineer & Security Researcher

SPOKEN L ANGUAGES A FE W THINGS ABOUT HOW I WORK

Ukrainian — native Six years on the same kind of problem from two sides —
English — working proficiency. I write reports and triage building products in React and Vue, breaking them in
threads with international programs in English daily. bug-bounty.
I switch between Vue and React without much friction.
Different projects pick different tools.
I prefer writing things down. Architecture notes, root-
cause writeups, PoC code — the team should be able to
read and re-run what I shipped.
I have worked in places where mistakes cost money or
worse — defense, energy infrastructure, KYC, banking,
lending — and I am used to that level of scrutiny.

file:///c%3A/Users/sleepy/Desktop/Ihor_Zvagolsky_Resume.html 5/5