--- title: "Souhail Mssassi, CCSSA, CBSP, CEE · Wavect Expert Network" canonical: https://wavect.io/experts/souhail-mssassi/ language: en description: "11 years in offensive security. Smart contract and Solana audits at Quantstamp and Halborn, now Enya Labs Security. Brought in when a Wavect build needs an …" image: "https://wavect.io/img/team/souhail-mssassi.jpg" --- ![Portrait of Souhail Mssassi, CCSSA, CBSP, CEE](https://wavect.io/img/team/souhail-mssassi.jpg) Independent specialist · Wavect Expert Network # Souhail Mssassi, CCSSA, CBSP, CEE 11 years in offensive security. Smart contract and Solana audits at Quantstamp and Halborn, now Enya Labs Security. Brought in when a Wavect build needs an adversarial review before mainnet, or when the threat model has to clear a regulated buyer. Read this first The engagements listed below were delivered **independently with this specialist's own clients**. They are **not** projects run through Wavect, and are shown here purely as evidence of competence. **These specialists are not Wavect employees.** We bring them into our engagements when a brief calls for depth that exceeds our own bench. The client books Wavect. We bring in the specialist. 01 · SIGNALS ## Why we vouch for them - **CCSSA**, CryptoCurrency Security Standard Auditor (C4 · CryptoCurrency Certification Consortium, 2023) - **CBSP**, Certified Blockchain Security Professional (Blockchain Council, 2023) - **CEE**, Certified Ethereum Expert (Blockchain Council, 2023) - Security Researcher, Enya Labs Security (current) - Former Senior Security Researcher, Quantstamp (Jul 2021–Jan 2024). Led audit teams on large [Solana](/glossary/solana/) programs and Solidity contracts. Reverse-engineered on-chain exploits at the assembly level. Built internal tooling for audit scoping and time estimation - Former Offensive Security Engineer, Halborn (May 2020–Jun 2021). Solidity [smart contract](/glossary/smart-contract/) audits, Solana program pentests, dApp and DEX/DeFi assessments, blockchain SDK and network infrastructure testing - Former Senior Security Consultant, Société Générale Morocco (Jun 2018–Apr 2020). DevSecOps integration across Nginx, Zuul, Keycloak, Jenkins. Mobile banking audits under EU and Moroccan compliance frames. 90% vulnerability reduction post-hardening - Prior consulting: IT6 Group (2017–2018) and Absec Cybersécurité (2014–2017). Vulnerability analysis and pentests for Moroccan banking (EURAFRIC), Ministry of Agriculture, Ministry of Health, trading platforms, and insurance - Blockchain security researcher, Cadi Ayyad University (Marrakech). Research in privacy-preserving smart contracts, [EVM](/glossary/evm/) internals, cryptography-informed system design - 22+ keynote speaker engagements across Moroccan universities, Arab Security Conference, Arab EmTech & Startups, BlaBlaConf, and GDG - Peer-reviewed publications in *Applied Sciences* (MDPI), *International Journal of Computer Networks and Applications*, and a Springer book chapter - Blockchain mentor, MentorCruise (since 2021) 02 · BIOGRAPHY ## In their own line of work Souhail started in cybersecurity in 2014 at Absec Cybersécurité in Morocco. Trading platforms, insurance mobile apps, vulnerability analysis, reverse engineering. IT6 Group followed, with security testing of Moroccan banking infrastructure (EURAFRIC), the Ministry of Agriculture platform code review, and the Ministry of Health platform vulnerability program. By the time he joined Société Générale Morocco as Senior Security Consultant, he was running DevSecOps integration across the development cycle. Mobile banking audits, risk analysis, EU and Moroccan compliance. He authored the pentesting methodology reference for Société Générale Morocco, hardened Nginx, Zuul, Keycloak, and Jenkins, and cut roughly 90% of the vulnerabilities surfaced in pre-engagement testing. In May 2020 he pivoted to [Web3](/glossary/web3/). Halborn brought him in as Offensive Security Engineer for Solidity smart contract audits, Solana program pentests, and DEX/ [DeFi](/glossary/defi/) assessments. Quantstamp hired him as Senior Security Researcher in 2021. There he led audit teams on large Solana programs and Solidity contracts, analyzed fraudulent transactions and reverse-engineered live exploits at the assembly level, and built internal tooling that helped auditors scope engagements and estimate time more accurately. He is now at Enya Labs on the security side, still in the same line of work: adversarial review of code that holds real value. Parallel to that, Souhail runs an academic and public-education track. He is a [blockchain](/glossary/blockchain/) security researcher at Cadi Ayyad University in Marrakech, with peer-reviewed publications on the blockchain trilemma in Applied Sciences (MDPI), on privacy-preserving application-layer frameworks in IJCNA, and a Springer book chapter on decentralized identity for the Web of Things. He has given 22+ keynotes and workshops across Moroccan universities, the Arab Security Conference, Arab EmTech, BlaBlaConf, and GDG. He has been a blockchain mentor on MentorCruise since 2021. He holds CCSSA, CBSP, and CEE charters across cryptocurrency custody, blockchain protocol security, and Ethereum. When Wavect brings Souhail in, the work is straightforward. Adversarial review of code that is about to hold value. Threat-modelling of an architecture before it is locked in. Forensics when something has already gone wrong. He is not a generalist consultant. He is the auditor who has read the assembly. 03 · WHEN WE BRING THEM IN ## Where Souhail Mssassi, CCSSA, CBSP, CEE plugs into a Wavect engagement Wavect builds the product. When a build crosses into a domain that exceeds our own bench, we bring in the specialist who already lives there. This is the brief for this one. - **Smart contract audit before mainnet** - Senior auditor at Quantstamp and Halborn. Solidity and Solana program audits, EVM-level review, threat modelling of dApps, DEXs, and DeFi protocols. When a Wavect build is going to mainnet and there is real value at stake, Souhail runs the adversarial pass before deployment. He has shipped enough audit reports to know which findings stop a launch and which can wait. - **On-chain forensics and reverse-engineering** - At Quantstamp he analyzed fraudulent transactions and reverse-engineered live exploits on the blockchain, reading assembly to understand what actually happened. When a client gets hit and the team needs a post-mortem that holds up in front of investors, regulators, or insurers, Souhail does the forensic work. - **DevSecOps for regulated buyers** - Société Générale Morocco: integrated DevSecOps into the development cycle, hardened Nginx, Zuul, Keycloak, and Jenkins, cut 90% of vulnerabilities, and authored the pentesting methodology reference. When a Wavect build needs to clear EU or Moroccan compliance, or sell into a regulated industry where audit trails matter, this is the depth we rent. - **Cryptography-informed architecture review** - Academic researcher at Cadi Ayyad University with peer-reviewed work on the blockchain trilemma, privacy-preserving application layers, and decentralized identity for IoT. When a build needs cryptographic primitives sense-checked before the system is locked in, Souhail reads the spec the way an attacker reads it. WHAT THE CREDENTIAL ACTUALLY COVERS ### What CCSSA, CBSP, and CEE actually cover Three charters, three layers of the same stack. CCSSA is the institutional standard for cryptocurrency custody and key management. CBSP covers offensive and defensive blockchain protocol security. CEE focuses on Ethereum, Solidity, and EVM internals. Holding all three means Souhail can talk to a custodian, a protocol team, and a smart contract engineer without translation. - CryptoCurrency Security Standard: key generation, wallet storage, key compromise procedures - Smart contract audit methodology, Solidity and Solana - EVM internals and bytecode-level review - Consensus-layer and protocol attack surface - Side-channel attacks and timing leakage - Reverse engineering of on-chain exploits and assembly analysis - Custody architecture, hot/cold wallet separation, multi-sig - Privacy-preserving transaction design and zero-knowledge primitives - Threat modelling for dApps, DEXs, and DeFi protocols - Responsible disclosure, ethics, and audit-report standards When Wavect brings Souhail in, this is the bench depth we are renting. It is not a credential we hold in-house. **Brought in. Not introduced.**We engage these specialists inside our own projects, when a brief calls for depth our bench does not carry. 04 · EXTERNAL ENGAGEMENTS ## Selected work, delivered with their own clients External engagement ### GDG on Campus ENSAM Casablanca 2024 Keynote speaker · Introduction to Blockchain Security A two-hour public webinar covering the threat surface of modern blockchain systems. Souhail walked through smart contract attack patterns, EVM-level pitfalls, and the disclosure workflow auditors use when a live protocol gets hit. The session is hosted as a publicly viewable artifact of his teaching depth. ![Souhail Mssassi on Introduction to Blockchain Security, recorded live at GDG on Campus ENSAM Casablanca on 9 November 2024.](/img/yt/mFul6U9Fkgk.jpg?v=0e120a3bfd76) Souhail Mssassi on Introduction to Blockchain Security, recorded live at GDG on Campus ENSAM Casablanca on 9 November 2024. Resources [GDG event page](https://gdg.community.dev/events/details/google-gdg-on-campus-ensam-casablanca-casablanca-morocco-presents-introduction-to-blockchain-security-with-souhail-mssassi/) [Watch on YouTube ↗](https://www.youtube.com/watch?v=mFul6U9Fkgk) 05 · PUBLICATIONS ## Peer-reviewed work Indexed academic publications. Full list on Google Scholar. 1. 2024 *Journal paper* - **The Blockchain Trilemma: A Formal Proof of the Inherent Trade-Offs Among Decentralization, Security, and Scalability** - Applied Sciences (MDPI) - [Read paper](https://www.mdpi.com/2076-3417/15/1/19) 2. 2025 *Journal paper* - **An Application-Layer Framework for Privacy-Preserving Blockchain Transactions and Smart Contracts** - International Journal of Computer Networks and Applications (IJCNA) - [Read paper](https://www.ijcna.org/Manuscripts/IJCNA-2025-O-05.pdf) 3. 2026 *Book chapter* - **Building Trust in the Web of Things: Decentralized Identity Management with Blockchain** - Signals and Communication Technology (Springer) - [Read paper](https://link.springer.com/10.1007/978-3-032-07671-7_7) Full indexed list, including additional papers on malicious-node detection, FPGA security, and constant-time approaches, is available on [Google Scholar](https://scholar.google.com/citations?user=TtAJ8YUAAAAJ&hl=en). 06 · TALKS & WORKSHOPS ## On stage, in their own words Public keynotes, workshops, and webinars delivered independently. Conference links and recordings where available. 1. Nov 2024 Webinar - **Introduction to Blockchain Security** - GDG on Campus ENSAM CasablancaOnline - [Event](https://gdg.community.dev/events/details/google-gdg-on-campus-ensam-casablanca-casablanca-morocco-presents-introduction-to-blockchain-security-with-souhail-mssassi/) [Recording](https://www.youtube.com/watch?v=mFul6U9Fkgk) - ![Recording](/img/yt/mFul6U9Fkgk.jpg?v=0e120a3bfd76) 2. 2023 Talk - **Blockchain technology and decentralized finance (DeFi)** - ENSA AgadirAgadir, MA 3. 2022 Conference talk - **Reverse engineering the EVM** - Arab EmTech & Startups ConferenceCasablanca, MA - [Event](https://arabemtechconference.com/) 4. Oct 2021 Conference talk - **Advanced attacks in decentralized applications** - BlaBlaConfOnline - [Event](https://blablaconf.vercel.app/) 5. Sep 2020 Workshop - **Advanced Attacks in dApps and Solidity** - Arab Security ConferenceOnline - [Event](https://www.arabsecurityconference.com/speaker-2020-souhail-mssassi/) 6. Sep 2019 Workshop - **Side Channel Attack in Blockchain** - Arab Security ConferenceOnline - [Event](https://www.arabsecurityconference.com/souhail_mssassi/) 7. Dec 2019 Talk - **Application security: website security and pentester methodology** - EHTPCasablanca, MA 8. Nov 2019 Talk - **The security of mobile applications** - EST EssaouiraEssaouira, MA 9. Oct 2019 Talk - **Wireless network security: Cellular networks** - Netcom ENSA KhouribgaKhouribga, MA 10. Oct 2019 Talk - **Data exfiltration in an isolated information system** - Netcom ENSA FesFes, MA 11. May 2019 Talk - **Careers in the IT security industry** - ENSA BerrechidBerrechid, MA 12. May 2019 Talk - **Cybersecurity professions and blockchain** - EMIRabat, MA 13. Apr 2019 Talk - **Physical security: Internet of Things** - Netcom ENSA TangerTangier, MA 14. Apr 2019 Workshop - **Application security: Advanced attacks on Web applications** - ENSA AgadirAgadir, MA 15. Mar 2019 Talk - **Application security: Advanced attacks on Web applications** - FST MarrakechMarrakech, MA 16. Feb 2019 Talk - **Introduction to blockchain** - 1337 KhouribgaKhouribga, MA 17. Dec 2018 Talk - **Security of wireless networks and decentralized applications** - ENCG MarrakechMarrakech, MA 18. Dec 2018 Talk - **Bitcoin and the professions of organizational security** - ENSA SafiSafi, MA 19. Dec 2018 Talk - **Physical security and the Internet of Things** - ENSA OujdaOujda, MA 20. Dec 2018 Talk - **Awareness on cyber security** - EMSI MarrakechMarrakech, MA 21. Oct 2018 Talk - **Protection of the confidentiality of the patient's personal data** - Faculty of Medicine AgadirAgadir, MA 22. Oct 2018 Talk - **Introduction to network and website security** - ENSA AgadirAgadir, MA 07 · LINKEDIN ## Recent posts Get to know how Souhail thinks. Recent posts, in their own words. 08 · LINKS & VERIFIED PROFILES ## Verify them yourself [Website mssassi.com](https://mssassi.com/) [LinkedIn linkedin.com/in/mssassi](https://www.linkedin.com/in/mssassi/) [Email souhail.mssassi@owasp.org](mailto:souhail.mssassi@owasp.org) Verified profiles & ratings [Website mssassi.com](https://mssassi.com/) [LinkedIn linkedin.com/in/mssassi](https://www.linkedin.com/in/mssassi/) [ORCID 0009-0004-4087-6370](https://orcid.org/0009-0004-4087-6370) [Google Scholar Indexed publications](https://scholar.google.com/citations?user=TtAJ8YUAAAAJ&hl=en) [ResearchGate Souhail Mssassi profile](https://www.researchgate.net/profile/Souhail-Mssassi) [MentorCruise Blockchain mentor](https://mentorcruise.com/mentor/souhailmssassi/) [Credly · CBSP Certified Blockchain Security Professional](https://www.credential.net/29eb0239-df6c-4ab2-a573-a203245d4cfd) [Credly · CEE Certified Ethereum Expert](https://www.credential.net/f14d7c6e-861b-41f6-a033-b3f14ba21968) ## Structured Data ```json { "@context": "https://schema.org", "@graph": [ { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ], "employee": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "founder": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "legalRepresentative": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "name": "Wavect GmbH", "subjectOf": { "@id": "https://wavect.io/verified-claims.json#dataset", "@type": "Dataset", "creator": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "description": "A machine-readable registry of quantitative and qualitative claims published by Wavect, with review dates, localized page appearances and public third-party citations where available.", "inLanguage": "en", "isAccessibleForFree": true, "license": "https://creativecommons.org/licenses/by/4.0/", "name": "Wavect verified publication claims", "url": "https://wavect.io/verified-claims.json" }, "url": "https://wavect.io/" }, { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "sameAs": [ "https://www.wikidata.org/wiki/Q139796365", "https://www.linkedin.com/in/wsdt", "https://github.com/wsdt" ], "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "sameAs": [ "https://www.wikidata.org/wiki/Q139796367", "https://www.linkedin.com/in/jocr77/", "https://github.com/jo-chris" ], "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/#website", "@type": "WebSite", "inLanguage": [ "en", "de", "es", "zh" ], "name": "Wavect", "potentialAction": { "@type": "SearchAction", "query-input": "required name=search_term_string", "target": { "@type": "EntryPoint", "urlTemplate": "https://wavect.io/search/?q={search_term_string}" } }, "publisher": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "url": "https://wavect.io/" }, { "@id": "https://wavect.io/experts/souhail-mssassi/#webpage", "@type": "WebPage", "dateModified": "2026-06-17", "inLanguage": "en", "isPartOf": { "@id": "https://wavect.io/#website", "@type": "WebSite" }, "lastReviewed": "2026-06-17", "url": "https://wavect.io/experts/souhail-mssassi/" } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "item": "https://wavect.io/", "name": "Home", "position": 1 }, { "@type": "ListItem", "item": "https://wavect.io/experts/", "name": "Expert Network", "position": 2 }, { "@type": "ListItem", "item": "https://wavect.io/experts/souhail-mssassi/", "name": "Souhail Mssassi, CCSSA, CBSP, CEE", "position": 3 } ] } ``` ```json { "@context": "https://schema.org", "@id": "https://wavect.io/experts/souhail-mssassi/#profilepage", "@type": "ProfilePage", "about": { "@id": "https://wavect.io/experts/souhail-mssassi/#person" }, "dateModified": "2026-06-17T15:21:01+02:00", "description": "11 years in offensive security. Smart contract and Solana audits at Quantstamp and Halborn, now Enya Labs Security. Brought in when a Wavect build needs an adversarial review before mainnet, or when the threat model has to clear a regulated buyer.", "inLanguage": "en", "isPartOf": { "@id": "https://wavect.io/#website", "@type": "WebSite" }, "mainEntity": { "@id": "https://wavect.io/experts/souhail-mssassi/#person", "@type": "Person", "address": { "@type": "PostalAddress", "addressCountry": "MA", "addressLocality": "Casablanca" }, "description": "11 years in offensive security. Smart contract and Solana audits at Quantstamp and Halborn, now Enya Labs Security. Brought in when a Wavect build needs an adversarial review before mainnet, or when the threat model has to clear a regulated buyer.", "identifier": "souhail-mssassi", "image": "https://wavect.io/img/team/souhail-mssassi.jpg", "jobTitle": "Security", "knowsAbout": [ "CryptoCurrency Security Standard: key generation, wallet storage, key compromise procedures", "Smart contract audit methodology, Solidity and Solana", "EVM internals and bytecode-level review", "Consensus-layer and protocol attack surface", "Side-channel attacks and timing leakage", "Reverse engineering of on-chain exploits and assembly analysis", "Custody architecture, hot/cold wallet separation, multi-sig", "Privacy-preserving transaction design and zero-knowledge primitives", "Threat modelling for dApps, DEXs, and DeFi protocols", "Responsible disclosure, ethics, and audit-report standards" ], "name": "Souhail Mssassi, CCSSA, CBSP, CEE", "sameAs": [ "https://mssassi.com/", "https://www.linkedin.com/in/mssassi/", "https://orcid.org/0009-0004-4087-6370", "https://scholar.google.com/citations?user=TtAJ8YUAAAAJ&hl=en", "https://www.researchgate.net/profile/Souhail-Mssassi", "https://mentorcruise.com/mentor/souhailmssassi/", "https://www.credential.net/29eb0239-df6c-4ab2-a573-a203245d4cfd", "https://www.credential.net/f14d7c6e-861b-41f6-a033-b3f14ba21968" ], "url": "https://wavect.io/experts/souhail-mssassi/" }, "name": "Souhail Mssassi, CCSSA, CBSP, CEE · Wavect Expert Network", "primaryImageOfPage": { "@type": "ImageObject", "contentUrl": "https://wavect.io/img/team/souhail-mssassi.jpg", "url": "https://wavect.io/img/team/souhail-mssassi.jpg" }, "url": "https://wavect.io/experts/souhail-mssassi/", "video": [ { "@id": "https://wavect.io/experts/souhail-mssassi/#video-mFul6U9Fkgk", "@type": "VideoObject", "description": "11 years in offensive security. Smart contract and Solana audits at Quantstamp and Halborn, now Enya Labs Security. Brought in when a Wavect build needs an adversarial review before mainnet, or when the threat model has to clear a regulated buyer.", "duration": "PT1H36M27S", "embedUrl": "https://www.youtube-nocookie.com/embed/mFul6U9Fkgk", "inLanguage": "en", "name": "Introduction to Blockchain Security", "publisher": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "thumbnailUrl": "https://i.ytimg.com/vi/mFul6U9Fkgk/maxresdefault.jpg", "uploadDate": "2024-11-10T00:00:00+00:00", "url": "https://www.youtube.com/watch?v=mFul6U9Fkgk" } ] } ```