From Party-Going Student to Smart Contract Security Expert

Carlos Alegre Urquizú was studying Software Engineering in Spain when he made an unconventional choice: leave the traditional path and carve out a career in blockchain security. Today, this self-driven security researcher from a small Spanish village uncovers critical vulnerabilities in smart contracts, helping to secure billions in digital assets for top blockchain protocols.
‍

This is the story of how Carlos used Updraft’s educational resources to evolve from a party-loving university student who rarely attended class into a professional smart contract security auditor (while shaping his own life philosophy).

My background and path to smart contract security

I grew up in a tiny Spanish village with the population density of a desert, tucked away in a quiet valley. I enrolled in the Autonomous University of Barcelona (UAB) to study Software Engineering, but "studied" is a generous term—I attended maybe 10% of my classes. The system felt inefficient, so I spent my time sleeping, partying, observing people, and learning to code from YouTube tutorials.

Despite my lack of attendance, I always excelled. As a kid, I topped my class by cramming the night before exams. That approach worked—until I hit blockchain security. That was my first real challenge, one that demanded discipline.

My interest in blockchain started around 2020, during one of Bitcoin’s boom cycles. I saw promising projects but realized I was in a "trust me, bro" situation if I couldn't read the code. It reminded me of my childhood obsession with verifying math proofs instead of taking them at face value. I had always asked: Why is this? Where does it come from?

‍Frustrated with traditional education, I left university to focus on self-study. Cryptocurrency and self-education merged perfectly when I discovered Patrick Collins’s full-stack tutorial, which introduced me to blockchain development and security.

So, why this path? Two reasons: money and freedom. My country felt outdated and bureaucratic. The conventional route promised frustration; forging my own path offered possibility.

My parents, though not formally educated, backed my choices without hesitation. They own a family bar and taught me the value of hard work, financial responsibility, and—most importantly—happiness. They gave me freedom because they trusted me. That trust became the foundation for my independent journey.
‍

My approach to learning and security

This is what works for me and others in the industry:

• Effort with deliberate rest: Being self-taught meant I had to be disciplined. 30 minutes one day, six hours another, but always learning. I only truly grasped the importance of rest after pushing myself to the limits during a recent Uniswap V4 auditing contest. When you slow down, rest. If you have a deadline, that's fine—use caffeine. But afterward, recover.
  
  
• Managing isolation: Security auditing is niche, remote, and isolating. Few outside of Crypto Twitter truly understand what we do. I balance this by attending conferences and maintaining friendships with “normal people” while embracing solitude when needed.
  
  
• Applying party principles to auditing: Oddly, the same rules that kept me partying three nights a week also apply to security research:
  
  
  • Stay fit.
  • Avoid anything that wrecks you.
  • Sleep as much as needed.
  • Move to the next task.
  • The cycle is simple: Stay healthy → Audit → Sleep → Repeat.

When I discovered CodeHawks through Patrick Collins’s YouTube, I immediately saw web3’s cybersecurity potential. Breaking things (rather than debugging or writing code) felt like a dream job, perfectly suited to my analytical and curious mindset.
‍

Learning with Updraft's courses and resources

Before Cyfrin Updraft even existed, I was already learning blockchain development through Patrick Collins’ tutorials. I found his content about two years ago, built projects based on his guidance, joined a hackathon, and later completed Updraft’s Foundry course.

When evaluating Updraft’s educational content against other platforms, there’s no real basis for comparison. Updraft has been more than enough for my learning journey.

Through Updraft, I built essential skills for my career:
‍

• Full-stack development: While I don’t use it daily, it provides a strong foundation should I ever shift to traditional cybersecurity or another field.
  
  
• Private key management: Critical for both personal security and company-wide protection.
  
  
• Smart contract auditing: I learned how to systematically review code and detect vulnerabilities.

The biggest lesson? Practice is everything. A course is a starting point, but hands-on experience is what truly builds expertise. I tackle one challenge just below my skill level, then one at my level, and then another slightly harder—constantly pushing forward.
‍

My current work and challenges

I’m a full-time contractor at Sigma Prime, where I review smart contracts to prevent hacks and protect users from financial losses. So altogether, I’ve spent a year in crypto cybersecurity, two years exploring blockchain, and four years studying software.

My auditing process is simple but effective. I use Excalidraw for diagramming, VSCode for coding, an empty text file for notes, and most importantly, my mind. I don’t rely heavily on automated tools since they’re widely used in contests and rarely provide a competitive edge. That said, they’re valuable for development.

So, what I love most about this job is the continuous learning. Every day, I uncover new concepts and attack vectors. And with full control over my schedule and location, it’s the perfect fit for how I work best.

Success factors and philosophy

I attribute my success to rejecting inefficiency and questioning unnecessary authority. Curiosity, skepticism, and a constant drive to learn have been instrumental, but above all, my personal philosophy, "Cheerfulism," has shaped my journey. It’s even an evolving project on my GitHub, a guide I refine as I grow.

Yet, staying ahead demands constant upskilling. I follow Crypto Twitter, attend conferences, engage with other researchers, and follow Cyfrin’s latest content. When the DevOps course launched, I watched it immediately to get up to speed. I also dive into security reports, explore trending topics, and, most importantly, audit new codebases—because hands-on work is the best teacher.
‍

Community experiences and advice for newcomers

The blockchain community has given me some of my most unforgettable experiences, like watching four dwarfs dressed as superheroes cheer on two overweight Muay Thai fighters at a DevCon 2024 side event in Bangkok. The rAAVE party? Equally legendary.

But beyond the wild moments, what I value most is the people. Despite our different backgrounds and cultures, we share the same core principles: freedom, long-term thinking, resilience, curiosity, independence, intelligence, ambition, and hard work. It’s inspiring to be part of it.

My advice for aspiring security researchers? Get in immediately. This industry is going to be massive. The earlier you start, the better your chances. It’s like joining Google 15 years ago. Easier then, much harder now.

The journey from self-taught developer to security expert has been long, exhausting, rewarding, and often lonely. But it’s also been deeply fulfilling, perfectly aligned with my mindset, and, most importantly, has given me freedom.

For me, success isn’t just about web3 security—it’s about the pursuit of happiness. Auditing turned out to be the perfect job for my analytical, curious nature. If it fits yours too, then let’s go. NOW is the time to start.

‍If any of this resonates with you, feel free to follow me on X and drop me a DM, or even read my book Cheerfulism to uncover the core philosophical principles that made me discover and do what I do today.