Contact
Ribbed steel and glass skyscraper rising from street level
Research

Advancing security
through knowledge.

Photo: Jorge Láscar · CC BY 2.0

Technical writing from our work: how vulnerabilities happen, how to find them, and how to build systems where they can't.

Vulnerability Research · 01Smart Contract Analysis · 02Web2 Security · 02Engineering · 02
Featured

Read-Only Reentrancy: When View Functions Lie

A reentrancy guard protects state changes, not state reads. How an honest-looking view function can hand a mid-transaction price to every protocol that trusts it.

Smart Contract Analysis3 min readRead article
Smart Contract Analysis

Rounding Is a Security Decision

Integer division always discards something. Who absorbs that loss — the protocol or the user — determines whether a vault can be drained one wei at a time.

Read article
Web2 Security

BOLA: The API Bug Your Scanner Will Never Find

Broken object-level authorization tops the OWASP API Security Top 10 for a reason. It is invisible to tools that do not understand who should own what.

Read article
Vulnerability Research

SSRF in the Cloud: Why the Metadata Service Still Matters

A URL-preview feature, an unvalidated fetch, and a link-local address. How server-side request forgery turns into cloud credentials — and how to close every step of the path.

Read article
Web2 Security

Hardening OAuth 2.0 Redirect Flows

Most OAuth vulnerabilities are not cryptographic. They are redirect handling, missing state, and flows that should have been retired years ago.

Read article
Engineering

Anatomy of a Finding: How We Write Security Reports

A vulnerability that cannot be understood, reproduced, and fixed by the people who own the code has not really been reported. Our structure, and the reasoning behind it.

Read article
Engineering

Invariant Testing with Foundry: Making Assumptions Executable

Every protocol rests on a handful of properties that must always hold. Writing them down as invariant tests turns an auditor's mental model into something a machine can attack.

Read article
Start a conversation

Have a question our research doesn't answer?

If you're working through a security problem in your own system, we're happy to talk it through.

Discuss an Assessment Our Methodology