Yechan Baeqwaz@theori.io

Introduction

• My primary area of interest is software security. I'm particularly focusing on scalable vulnerability detection.
  • Xint: AI-based Web Application Security Testing
  • ChainLight WARD: Static Analysis for Solidity Smart Contracts
  • Rudra: Static Analysis for Rust Memory Safety Issues
• I believe one's programming principles reveal a lot about how they approach engineering. For me, they are:
  1. Parse, Don't Validate: make invalid states unrepresentable
  2. You Ain't Gonna Need It (YAGNI): do not add complexity until it is absolutely necessary
  3. Programming as Theory Building: programming is about building a shared mental model

---

Work Experience

Theori Korea, Staff Researcher Sep. 2022 - presentSeoul (South Korea)

Xint, Product Owner 2025 - present

• Built a research prototype of an AI-based web application security testing solution as a core developer
• Later, leading its productization into a commercial SaaS platform as the team lead

ChainLight, Web3 Automated Risk Detection (WARD) Part Lead 2022 - 2024

• Led the development of a high-performance static analysis engine for Solidity programs, architecting AST, IR, and several analyzers
• Our engine could analyze all smart contracts deployed on Ethereum (reaching millions) in 3 hours on a single EPYC server
• Discovered multiple zero-days, preventing security breaches up to $6M

---

Education

Georgia Institute of Technology Aug. 2019 - May. 2022Atlanta, Georgia (United States)

• M.S. in Computer Science
• Member of Systems Software & Security Lab (SSLab), advised by Professor Taesoo Kim

Pohang University of Science and Technology (POSTECH) Mar. 2015 - Feb. 2019Pohang (South Korea)

• B.S. in Creative IT Engineering
• Summa Cum Laude and Valedictorian Honor (best GPA in class of 2019)

---

Publication

1. Spacelord: Private and Secure Smart Space Sharing Yechan Bae, Sarbartha Banerjee, Sangho Lee, Marcus Peinado. Digital Threats: Research and Practice 5.2, 2024. [paper] (extended version)
2. Spacelord: Private and Secure Smart Space Sharing Yechan Bae, Sarbartha Banerjee, Sangho Lee, Marcus Peinado. Proceedings of the 38th Annual Computer Security Applications Conference (ACSAC), Austin, TX, USA, December 5-9, 2022. [paper] [artifact]
3. Rudra: Finding Memory Safety Bugs in Rust at the Ecosystem Scale Yechan Bae, Youngsuk Kim, Ammar Askar, Jungwon Lim, Taesoo Kim. Proceedings of the 28th ACM Symposium on Operating Systems Principles (SOSP), Virtual Event, Germany, October 26-29, 2021. (acceptance rate: 15.5% = 54/348), Distinguished Artifact Award [paper] [code] [video]
   Discovered and reported 100+ CVEs as part of the project, including memory safety bugs in the Rust standard library

---

Teaching Experience

• Teaching Assistant, Design of Operating Systems, Georgia Tech, Spring 2020
  Educational OS written in Rust, developed course materials and lab assignments

---

---

Internship

Microsoft Research, Research Intern May. 2020 - Aug. 2020Remote (United States)

• Participated in Spacelord project (see the Publication section)
• Implemented bare-metal provisioning and remote attestation on U-Boot to support authenticated booting in ARM SoCs

National Cancer Center, Research Assistant Apr. 2019 - June 2019Goyang (South Korea)

• Implemented DICOM medical image visualization and segmentation with Qt framework
• Audited and refactored control code for breast cancer biopsy robot

Oracle Labs Parallel Graph AnalytiX (PGX), Research Assistant Feb. 2018 - June 2018Belmont, California (United States)

• Developed shared IR execution engine for PGX single-machine (Java) and distributed (C++) runtime
• Implemented parser, type checker, and expression evaluator for PGX query expressions with Spoofax language workbench

POSTECH Database & Data Mining Lab, Undergraduate Intern Winter 2016 - Spring 2017Pohang (South Korea)

• Developed adaptive indexing method to improve performance of a graph database (advisor: Wook-Shin Han)

---

Honors and Awards

Research

• Distinguished Artifact Award, ACM SOSP (Rudra project) 2021

Scholarship

• Kwanjeong Study Abroad Scholarship ($25,000/year) 2019 - 2022
• Samsung Software Membership ($4,000/year) 2016 - 2019

Capture the Flag & Programming Competition (selected)

• Cyber Conflict Exercise #2 (10M KRW) (Team: The Gosling) 2024
• DEF CON CTF Finals #1 (Team: Maple Mallard Magistrates) 2024
• DEF CON CTF Finals #1 (Team: Maple Mallard Magistrates) 2023
• DEF CON CTF Finals #5 (Team: perfect r00t) 2022
• Real World CTF #1 (Team: perfect r00t) 2022
• HITCON CTF #1 (Team: perfect blue) 2021
• DEF CON CTF Finals #4 (Team: StarBugs) 2021
• Google Hackeler8 (Team: r00timentary) 2020
• DEF CON CTF Finals #8 (Team: r00timentary) 2019
• DEF CON CTF Finals #21 (Team: KaisHack+PLUS+GoN) 2018
• Google CTF Finals #7 (Team: LeaveCat-PLUS) 2018
• Samsung CTF Special Award in Cryptography (5M KRW) 2018
• DEF CON CTF Finals #11 (Team: hacking4danbi) 2017
• Samsung CTF 3rd Award (1M KRW) 2017
• Samsung Collegiate Programming Cup 4th Award (2M KRW) 2017
• Samsung Collegiate Programming Cup 3rd Award (4M KRW) 2016
• Code Gate CTF University #3 (2M KRW) (Team: PLUS) 2016
• Korea National Crypto Challenge Runner Up Award (1.5M KRW) (Yechan Bae, Doyoung Ham, Junho Han) 2016
• Microsoft Imagine Cup Korea #1 in the innovation division (Team: SangSang) 2015
• Asia-Pacific Informatics Olympiad Bronze Medal 2014
• Asia-Pacific Informatics Olympiad Bronze Medal 2013

I post my write-ups on GitHub.

---