Writing about the work.
Vulnerability explainers, exploit post-mortems, contest findings and detection content. We publish what we learn because it is a better argument than a sales page.
Vulnerability guides
Our longest-running series: one worked explanation per bug class, with real code and a test that proves it.
Reentrancy in Solidity: examples, exploits and fixes
How reentrancy attacks work in Solidity, with vulnerable and fixed code, a Foundry test to catch it, and the hacks it caused.
Broken access control in Solidity: examples, exploits and fixes
Missing access control in Solidity: unprotected functions, wrong modifiers, and how to test that only the right addresses can call privileged code.
Integer overflow and underflow in Solidity: examples, exploits and fixes
Integer overflow and underflow in Solidity: what changed in 0.8.0, where unchecked blocks reintroduce the risk, and how to test arithmetic safely.
Unchecked call return value in Solidity: examples, exploits and fixes
Why ignoring the return value of call, send, or a non-reverting ERC-20 transfer silently breaks accounting, and how to handle it correctly.
tx.origin authentication in Solidity: examples, exploits and fixes
Why authenticating with tx.origin instead of msg.sender lets any contract you interact with drain your funds, with a worked phishing example.
Unsafe delegatecall in Solidity: examples, exploits and fixes
How delegatecall to an untrusted address hands over your entire contract, including storage and ownership, and the storage-collision bugs it causes.
What’s coming
The blog is new. Planned and in progress:
- Contest writeups. Every finding we submit to a public audit contest, explained.
- Exploit post-mortems. Analysis of live incidents, published while they are still relevant.
- Detection content. Sigma and SPL rules we have written, with the reasoning behind them.
- Tooling. Foundry invariant testing, Slither configuration, and the parts of the workflow that are genuinely worth writing down.
If you want these as they go up, the fastest way is to follow the GitHub organisation. Everything lands there first.