I've spent four years building production vault and leverage infrastructure: BoringVault stacks, ERC-4626 and ERC-7540 vaults, flash-loan leverage into Aave. Now I take on contract builds and fixed-price reviews for teams shipping vault code.
You work with me directly, from scoping to mainnet.
William Schiller
Lead Solidity Engineer · Remote, UTC+7
I was lead Solidity engineer on Paravel's leveraged-yield vaults, live on Ethereum mainnet since Sep 2025. The platform is Paravel's. These are its numbers, and every one is on chain.
Fixed-price work
I read every line of your vault contracts and attack the parts that hold money: share pricing, rounding, deposit and redeem flows, async request queues, fees, access control and upgrade paths. You get a written report. Each finding has a severity, a failing test that proves it, and a fix.
A Foundry handler-based invariant suite for your vault, written into your repo and run in your CI. It checks that shares always map to assets, that rounding always favours the vault, and that no user can take out more than they put in plus yield. A suite like this caught a critical rounding bug in the Nexade vault before launch.
The suite first, then the review. The invariants find the bugs that line-by-line reading misses, and the review covers what invariants cannot express. You keep the suite, so every later change gets the same checks.
The price depends on the size of the code. I fix it in writing after a 30-minute call and a read of your repo, before any work starts.
Book a scoping call →
Built for Paravel as lead Solidity engineer. I designed the vault architecture on Veda's BoringVault, wrote the decoder contracts and Merkle policies that limit each trading agent, and built the flash-loan leverage loops. One transaction took 1.4 ETH of equity to a 15.5 ETH position on Aave.
I designed and built Yelay's async vault, through Faculty Group. The first design shared one stored share price across vaults, so one vault's settlement could move another vault's NAV. I split it into a pool token and a client token per vault, which removed the cross-vault leak.
Visit Yelay →
BlockHelix · My own productEvery trade is executed through BlockHelix and checked on chain against a permission allowlist. Peg, price-impact and exit-cost checks run on every position and report breaches. Non-custodial, live on Ethereum mainnet and Base.
Oolong · My own capital
Oolong trades my own money through the same stack I build for clients: BoringVault books and Pendle PT loops on Morpho. BlockHelix executes every trade, and each one is checked on chain against a permission allowlist. The live record is public, so you can check the numbers yourself.
Live from the public record
See the live record →
Lead Solidity engineer for Nexade, on Arbitrum. I replaced a MasterChef rewards model with ERC-4626 epoch staking vaults: a 7-day deposit window and a 90-day lock that match the payout cycle of the underlying invoices. Rewards accrue only while funds are locked, which stops deposit-claim-exit sniping. My invariant suite caught a critical rounding bug before launch.
How I work
01
A 30-minute call and a read of your repo. You get the scope and a fixed price in writing before any work starts.
02
I work in your repo and your Slack. You see findings and commits as they land, not in one drop at the end.
03
Every finding comes with a failing test. Every build ships with an invariant suite and goes through a third-party audit before it touches user funds.
04
I stay through the audit fixes and the mainnet deploy, and hand over docs your auditors and engineers can work from.
Featured writing
An async vault prices shares from the last NAV attestation, so the price lags the assets. Anyone who sees the true value first can deposit or redeem against the stale price. The article maps that attack surface and the designs that contain it.
Read the article →How Do Vaults Price Redemptions? ERC-4626 vs ERC-7540When the price is fixed, who carries NAV risk, and the bugs to check →The License Is the MoatWhy vault curation is the last unlicensed layer in DeFi →About
I'm William Schiller. I run DeFi Data, a UK company, and work remotely from UTC+7, which overlaps both EU and Asia hours. Before vaults, I taught Solidity security, MEV and EVM internals at Extropy to workshops of 100+ developers, and reviewed contracts with Slither and invariant testing. I won Best Use of Safe{Core} at ETHGlobal New York 2023, and BlockHelix placed 3rd of 454 at the Colosseum Agent Hackathon.
Book a 30-minute call. Tell me what the vault does and when you plan to launch, and I'll tell you what I would test first.
Or email will@defidata.dev