Ángel Morillas

I joined a team of 3 developers to help finishing up their MVP, a collaborative rich note-taking website supporting social features.

I was hired as the company's only node.js developer to customize and modify the source code of Vendure, a headless open-source ecommerce solution, adding a lot of custom features and integraing it within the company´s ecosystem and third party services (infrasys, thermal printer, mailing, etc.). Once the backend was done I was moved to the frontend team to fix some long-standing problems like implementing a graph-based spatial navigation system for TVs to replace the previous one, based on HTML ids and searching the next element pixel by pixel on the viewport, which was very buggy and presented inconsistencies across TV models. I found a XSS vulnerability that allowed any guest to gain access our internal "god-mode" JWT and an unsalted MD5 of the password of staff members accessing the admin dashboard.

I found a bug on Obyte, a DAG-based cryptocurrency. The bug allowed an attacker to halt the whole network by sending a manually constructed payload that dragged it into an invalid state. I reported the bug, deployed a Proof of Concept exploit on a Testnet that brought it down and qualified for the bounty, getting a public acknowledgement on their Discord server (https://discord.com/channels/534371689996222485/536158659508699159/867475902584979496)