Asymmetric Research

Blog

Some of our latest writing.

Vulnerability research, engineering notes, and incident write-ups from the team.

Latest

8 min read

Fuzzing for a Solana Governance Bug

For its first six weeks on mainnet, Solana's validator governance program let any validator silently erase its delegators' dissenting votes. We explain the bug, how close it came to flipping SGP-0002, and how Crucible finds it in under a second.

Kai Parker

11 min read

Under the Hood: Engineering Commonware Fuzzing

Fuzzing Commonware isn't a pile of one-off harnesses. It's engineered: deterministic runtime, controlled randomness, reviewable fuzz targets, reproducible crashes, promoted regressions.

Denis Kolegov

6 min read

All Roads Lead to Panic: A Starknet Oracle Story

Pragma is one of Starknet's main oracles, pricing collateral and liquidations for lending protocols holding tens of millions on-chain. This post explains how a missing access-control check could have let anyone disable its core price feeds for a few cents.

Magnus Woodgate

6 min read

Across Solana Event Spoofing

On Solana, events are often reconstructed from transaction traces, and failed transactions still emit data. This bug in Across could have allowed attackers to spoof deposit events and trick relayers into filling orders with no real deposit behind them.

Maxwell Dulin

Earlier posts

Solana p-token: Catching a Bug Before Mainnet

Felix Wilhelm

Understanding Agents: Code Coverage for Coding Agents

Liam Wachter

Solana Vulnerabilities That Aren’t: Unpacking Common Misreports

John Saigle

Wrong Offset: Bypassing Signature Verification in Relay

Felix Wilhelm

Threat Contained: marginfi Flash Loan Vulnerability

Felix Wilhelm

Behind the Scenes of a Blocked Phishing Attempt

John Bottoms

Boredom Over Beauty: Why Code Quality is Code Security

John Saigle

Finding Fractures: An Intro to Differential Fuzzing in Rust

Anthony Laou Hine Tsuei, Nick Lang

Invocation Security: Navigating Vulnerabilities in Solana CPIs

Maxwell Dulin

Corrupt Commitments: Proposer Equivocation Bug in Helix MEV Relay

Troy Sargent

Ghost in the Block: Ethereum Consensus Vulnerability

Giuseppe Cocomazzi

Circle's CCTP Noble Mint Bug

Ruslan Habalov

Evmos Precompile State Commit Infinite Mint

Jason Matthyser

Cosmos IBC Reentrancy Infinite Mint

Maxwell Dulin

Ethereum Log Confusion in Polygon's Heimdall

Felix Wilhelm

Subscribe to be notified whenever we publish new security research.

Get the latest