bshyuunn

Security researcher

Songhyun Bae

@bshyuunn

I'm Songhyun Bae, aka bshyuunn or hyuunn. I'm a Cyber Defense student at Korea University and a member of CyKor. My experience includes software vulnerability analysis, bug bounty research, and smart contract auditing. My interests include vulnerability discovery, fuzzing, kernel security, Web3 security, AI for security, and AI agent security.

§1Experience

Smart Contract Auditor2025.08 — 2026.04
Hashlock, Remote — EVM smart contract audits across Solidity and Vyper

§2Education

Korea University2024.03 —
B.S. Cyber Defense · Seoul, South Korea

§3Disclosed Bugs

Apple 1
CVE-2025-24184 CoreMedia Playback — Denial of service
Anthropic 1
HackerOne #3795252 Claude Code — High
Toucan 3
Immunefi #40684 Toucan Protocol — Medium
Immunefi #40596 Toucan Protocol — Medium
Immunefi #40497 Toucan Protocol — Low
Open Source 3
CVE-2025-30216 NASA CryptoLib — Heap-based buffer overflow
GHSA-58p5-r2f6-g2cj Pixar OpenUSD — Use-after-free
CVE-2024-42358 PDFio TTF parser — Denial of service
WordPress Plugin 4
CVE-2024-24714 Icons Font Loader — Arbitrary file upload
CVE-2023-48329 Fast Custom Social Share — Stored XSS
CVE-2023-39924 Simple File List — Stored XSS
CVE-2023-33213 wpView — Stored XSS
Others 5
CVE-2024-45872 Bandiview PSD parser — Heap-based buffer overflow
CVE-2024-45871 Bandiview PSD parser — Denial of service
CVE-2024-45870 Bandiview JXR parser — Denial of service
KVE-2024-0410 SGA ViruChaser — DLL hijacking
KVE-2024-0395 Hauri ViRobot — DLL hijacking

§4Audit Contests2C · 18H · 19M · 1L

1stStrobe SC · HackenProof 1C 2025
1stNeutrl Protocol · Sherlock 1M 2025
3rdCoinbase EIP-7702 Proxy · Cantina 1M 2025
5thRAAC Core · CodeHawks 8H10M 2025
5thFolks Finance Staking · Immunefi 1L 2026
10thENS · Immunefi 1C1H1M 2026
10thInterPol · Cantina 1H2M 2024
···all contests

§5Awards