Research that turns exploits into engineering knowledge.
Evidence-led investigations into smart contracts, runtimes, wallets, and the protocol failures shaping Web3 security.
- Research notes
- 30
- Research domains
- 6
- Access
- Open archive
01 / Featured research
Inside the latest findings
Deep technical work selected for relevance, evidence, and practical value.
Source Says 50. Bytecode Says 0: The Sui Move Compiler Bug That Could Silently Drop Payments
Smart contracts execute bytecode, not the source developers review. We investigate a fixed Sui Move match-lowering bug that could erase a value-flow branch, turning a modeled 50-unit credit into 0 while still producing valid, verifiable bytecode.
Sui Mainnet Halt of May 28, 2026: An Address Balance Gas Underflow Post-Mortem
A deep post-mortem of the May 28, 2026 Sui mainnet stall: a single missing case at the seam of Address Balance and coin reservations let a failed transaction emit a poisoned accumulator Split, underflowing the per-checkpoint settlement system transaction and halting every validator.
HB Token Exploit Analysis: ~$193K Lost to AMM Reserve Manipulation via Reward Path
On April 7, 2026, HB Token on BSC was exploited for ~$193,936 USDT. The attacker leveraged a structural flaw in the protocol's reward distribution mechanism — tightly coupled with live AMM reserve mutations — to distort internal spot pricing and drain the pool.
02 / Research index
Explore the technical archive
Find investigations by domain, affected system, or technical concept.
Showing 27 publications
One Line, All Funds: How a Static IV Turned Nightly Wallet's Encryption Into a Two-Time Pad
A single const declaration at module scope reused the same AES-CTR initialization vector for every encryption call, enabling full mnemonic and private key recovery from any Nightly Wallet vault — without ever knowing the user's password.
How a One-Byte Discriminator Can Silently Break Anchor's Event System
A deep dive into a dispatch hardening gap in the Anchor framework where custom discriminators can shadow the Event CPI sentinel, silently disabling the event system with no compiler warnings.
In-Depth Security Risk Analysis of the Fingerprint Browser Industry
A comprehensive security analysis revealing systemic vulnerabilities in fingerprint browsers that have led to millions in losses. This report examines real-world incidents, technical vulnerabilities, and the dangerous trust model these products create for users managing high-value digital assets and cryptocurrency wallets.
SwapNet Attack Analysis: $13.43M Lost to Arbitrary Call Vulnerability
A detailed vulnerability analysis of the SwapNet protocol exploit on January 25, 2026, where an attacker exploited arbitrary call vulnerabilities in the smart contracts to steal approximately $13.43 million across multiple blockchains.
Truebit Protocol Attack Analysis: 8,535 ETH Lost to Integer Overflow
A detailed vulnerability analysis of the Truebit Protocol exploit on January 8, 2026, where an attacker exploited an integer overflow vulnerability in the token purchase price calculation logic, resulting in a loss of 8,535.36 ETH.
Deep Dive: The yETH Weighted StableSwap Exploit - Part 1
An in-depth analysis of the yETH Weighted StableSwap exploit, exploring how the transition from Curve's invariant to a weighted model introduced critical vulnerabilities through product-term collapse.
Prediction Markets Are Becoming Financial Infrastructure. Their Security Is Not Ready.
The numbers back this up. During the 2024 U.S. election, prediction markets saw unprecedented volume and mainstream adoption, yet their security infrastructure remains immature.
Nemo Protocol Hack: $150K Loss Analysis on Sui Blockchain
Detailed breakdown of the Nemo Protocol exploit on Sui blockchain, examining the vulnerability and attack methodology.
TON Blockchain: Tolk vs FunC Security Comparison
Comprehensive security analysis comparing TON's new Tolk language with the established FunC for smart contract development.
Radiant Capital Hack: $58M Cross-Chain Attack Analysis
In-depth analysis of the Radiant Capital exploit that resulted in $58 million in losses across multiple chains.
Stacks Clarity Smart Contract Security Guide
Comprehensive security guide for developing secure smart contracts using Clarity on the Stacks blockchain.
DeFi Oracle Manipulation: Attack Patterns and Defenses
Analysis of oracle manipulation attacks in DeFi protocols and recommended defensive measures.
Move Language Security: Aptos vs Sui Implementation Differences
Comparative analysis of Move language security considerations between Aptos and Sui blockchains.
TON Smart Contract Security Deep Dive
A comprehensive analysis of security considerations for smart contract development on The Open Network (TON).
ZK-Rollup Security: Current Landscape and Risks
Security analysis of zero-knowledge rollup implementations and their trust assumptions.
Auditor's Handbook: Dissecting the Security Layers of Clarity
A comprehensive comparison of Clarity and Solidity smart contract languages from a security auditor's perspective.
MEV Protection Strategies for DeFi Protocols
Comprehensive guide to protecting DeFi protocols and users from Maximal Extractable Value attacks.
DeFi Security Best Practices for 2024
Essential security practices for DeFi protocol developers based on our audit experience across hundreds of protocols.
Account Abstraction Security: ERC-4337 Risks and Mitigations
Security analysis of ERC-4337 account abstraction and potential vulnerabilities in smart contract wallets.
NFT Smart Contract Security Guide
Common vulnerabilities in NFT contracts and how to prevent them, based on our analysis of major NFT exploits.
Cosmos IBC Security: Cross-Chain Communication Risks
Analysis of Inter-Blockchain Communication (IBC) security in the Cosmos ecosystem.
Cross-Chain Bridge Security Analysis
Deep dive into cross-chain bridge vulnerabilities that have led to billions in losses.
Restaking Security: EigenLayer and AVS Risks
Security analysis of restaking protocols like EigenLayer and the risks of Actively Validated Services.
Flash Loan Attack Patterns and Prevention
Comprehensive analysis of flash loan attack patterns observed across DeFi protocols.
Chrome Extension Wallet Ciphertext Replacement Attack
Many chrome extension wallets use indexedDB to store encryption key data, but there exists a cipher text replacement attack that can steal user's private keys or mnemonic phrases.
Solana Program Security Guide
Security considerations unique to Solana program development and common vulnerability patterns.
Move Language Security on Aptos
Security analysis of the Move programming language and Aptos-specific considerations.
New findings, delivered with evidence.
Receive new vulnerability research, reproductions, and mitigation guidance from ExVul.
- Technical disclosures
- Root-cause analysis
- Reproducible findings