PPavel Espitia
Start a conversation

Independent product engineer · Medellín

Pavel builds extraordinary products at the intersection of AI, security, and Web3.

Senior product engineer turning adversarial systems, agentic software, and cryptographic infrastructure into products people can actually use.

Explore the product universeContact Pavel

Live system map

Four products. One connected practice.

  1. spectr-aiAI · Security · Web3
  2. ArgusAI · Security · Web3
  3. Argus LensSecurity · Developer tools
  4. ScryAI · Web3

Product worlds

Built where complexity becomes useful.

Each product begins with a difficult system and ends with a decision people can understand.

AI security intelligence

spectr-ai

An AI smart-contract auditor for Solidity and Vyper.

Open sourceAISecurityWeb3
spectr-ai auditing a smart contract and presenting a structured security report.
The problem

Security teams need fast, structured analysis without losing outputs inside an opaque chat transcript.

The response

spectr-ai audits deployed contracts or source files and produces JSON, SARIF, and styled HTML reports.

The difference

Runs with Claude or local Ollama models and turns findings into artifacts that fit engineering workflows.

Inputs
Deployed addresses, Solidity, and Vyper source
Outputs
JSON, SARIF, and styled HTML
Model options
Claude or local Ollama models
Source

Transaction defense

Argus

An AI transaction firewall for crypto wallets.

Chrome Web StoreAISecurityWeb3
Argus flagging an unlimited token approval as critical before wallet signing.
The problem

Wallet confirmations hide dangerous approvals and contract behavior behind raw transaction data.

The response

Argus intercepts a signing request, decodes its behavior, and explains the risk before approval.

The difference

Deterministic heuristics answer immediately while an LLM explains the stakes in plain language.

Decision point
Before wallet approval
Analysis
Decoded intent, heuristics, and plain-language risk
Chrome Web Store

Supply-chain defense

Argus Lens

A static malware scanner for repositories you are asked to run.

LiveSecurityDeveloper tools
Argus Lens accepting a repository URL and returning a static malware verdict.
The problem

A repository can execute hostile code during install or build before a developer reviews what it contains.

The response

Argus Lens inspects repository signals such as build-time execution, lockfile evasion, and hostile git hooks without running the target.

The difference

The detectors grew from two real supply-chain attacks and keep analysis static: nothing is cloned, installed, or executed by the scanner.

Execution model
Static inspection; target code is not executed
Surfaces
Web, VS Code, and Chrome
Open Argus Lens

Contract intelligence

Scry

A conversational interface for deployed EVM contracts.

LiveAIWeb3
Scry showing a contract-address field, chain selector, and conversational analysis.
The problem

Understanding a deployed contract often requires explorers, ABI hunting, and manual decoding before a useful question can be asked.

The response

Scry lets people select a chain, provide a contract address, and ask questions in plain English.

The difference

It resolves verified ABIs and can reconstruct an interface from bytecode with whatsabi when source metadata is unavailable.

Coverage
Six EVM chains
Unverified contracts
ABI reconstruction with whatsabi
Open Scry

Proof layer

Story when you want context. Evidence when you want receipts.

STATEMIND

DEGA ETH ISPO

A non-custodial Ethereum ISPO built around stETH staking and user-controlled withdrawal.

Audit reportSourceDeployment
storming0x

DEGA TGE claim

Multi-chain EIP-712 token claims with replay protection across chains and contracts.

Audit reportSource

Capabilities, connected to shipped work

AI systems that ship

Agentic products, local and hosted models, structured outputs, and interfaces that explain rather than obscure.

  • spectr-ai
  • Argus
  • Scry
  • Building an AI Smart Contract Auditor: Architecture and Lessons

Security engineering

Threat modeling, static analysis, pre-audit hardening, and security decisions placed inside the workflow.

  • Argus
  • Argus Lens
  • spectr-ai
  • Signature Replay Attacks in Solidity: The Bug That Looks Correct

Web3 infrastructure

Smart contracts, EIP-712 flows, wallet interactions, ABI reconstruction, and multi-chain systems.

  • Scry
  • Argus
  • Solidity vs Vyper: Security Differences Every Auditor Should Know

Product architecture

Connected systems that turn complex rules into understandable, resilient product experiences.

  • spectr-ai
  • Argus Lens
  • Scry

Writing as signal

Field notes from systems under pressure.

  1. 01The $292M KelpDAO Bridge Hack: Why the Audit Wasn't the ProblemHow operational controls fail even when contract reviews exist.Incident analysis · 2026
  2. 02Signature Replay Attacks in Solidity: The Bug That Looks CorrectA practical explanation of signatures, domains, and replay boundaries.Smart contract security · 2026
  3. 03Solidity vs Vyper: Security Differences Every Auditor Should KnowSecurity trade-offs across two production smart-contract languages.Audit engineering · 2026
  4. 04Building an AI Smart Contract Auditor: Architecture and LessonsThe architecture and constraints behind spectr-ai.AI security tooling · 2026
Explore the complete archive

About

Engineering judgment built across expensive failure modes.

Before Web3, Pavel built software for banks, airlines, energy, gaming, and healthcare—places where failure is expensive. Since 2018, his work has centered on protocols, smart-contract security, and products that make complex systems understandable.

The AI thread runs through agent wallets, autonomous worlds, security tooling, medical claims, and engineering pipelines. The common discipline is the same: design the system, expose the evidence, and make the difficult thing usable.

  1. 2023 · nowIndependent senior engineerWeb3 security, AI products, and architecture
  2. 2021 · 2023Blockchain DeveloperFIWORK
  3. 2019 · 2021Senior Software EngineerPSL Corp · MILL5
  4. 2018 · 2019Frontend & Blockchain DeveloperBlocksize · eFIN DEX
  5. 2009 · 2018Enterprise engineeringBanking, gaming, aviation, and energy

Selected clients

Wells Fargo · Electronic Arts · Inter-American Development Bank · Deloitte · Bancolombia · Suramericana · Avianca · Ecopetrol

Networks

Ethereum · BNB Chain · Optimism · Base · Arbitrum · Polygon · Midnight

Open channel

Building something difficult? Good.

Building something difficult? Good. Bring the protocol, the adversarial workflow, or the AI product that needs to become real.

Open your mail app

Quick navigation

Navigate the portfolio