Blog

Some of our latest writing.

Vulnerability research, engineering notes, and incident write-ups from the team.

Latest

5 min read

Conference week opsec: a guide

Conferences expose people and teams to social engineering, physical threats, and unwanted attention. Learn how to limit your exposure, verify new contacts, and plan for safer travel.

Brandon Pate

8 min read

Fuzzing for a Solana Governance Bug

For its first six weeks on mainnet, Solana's validator governance program let any validator silently erase its delegators' dissenting votes. We explain the bug, how close it came to flipping SGP-0002, and how Crucible finds it in under a second.

Kai Parker

11 min read

Under the Hood: Engineering Commonware Fuzzing

Fuzzing Commonware isn't a pile of one-off harnesses. It's engineered: deterministic runtime, controlled randomness, reviewable fuzz targets, reproducible crashes, promoted regressions.

Denis Kolegov

6 min read

All Roads Lead to Panic: A Starknet Oracle Story

Pragma is one of Starknet's main oracles, pricing collateral and liquidations for lending protocols holding tens of millions on-chain. This post explains how a missing access-control check could have let anyone disable its core price feeds for a few cents.

Magnus Woodgate

Earlier posts

Across Solana Event Spoofing

Maxwell Dulin

Solana p-token: Catching a Bug Before Mainnet

Felix Wilhelm

Understanding Agents: Code Coverage for Coding Agents

Liam Wachter

Solana Vulnerabilities That Aren’t: Unpacking Common Misreports

John Saigle

Wrong Offset: Bypassing Signature Verification in Relay

Felix Wilhelm

Threat Contained: marginfi Flash Loan Vulnerability

Felix Wilhelm

Behind the Scenes of a Blocked Phishing Attempt

John Bottoms

Boredom Over Beauty: Why Code Quality is Code Security

John Saigle

Finding Fractures: An Intro to Differential Fuzzing in Rust

Anthony Laou Hine Tsuei, Nick Lang

Invocation Security: Navigating Vulnerabilities in Solana CPIs

Maxwell Dulin

Corrupt Commitments: Proposer Equivocation Bug in Helix MEV Relay

Troy Sargent

Ghost in the Block: Ethereum Consensus Vulnerability

Giuseppe Cocomazzi

Circle's CCTP Noble Mint Bug

Ruslan Habalov

Evmos Precompile State Commit Infinite Mint

Jason Matthyser

Cosmos IBC Reentrancy Infinite Mint

Maxwell Dulin

Ethereum Log Confusion in Polygon's Heimdall

Felix Wilhelm

Subscribe to be notified whenever we publish new security research.

Get the latest