https://asymmetric.com/blog/ Security research from Asymmetric Research https://asymmetric.com/blog/under-the-hood/ https://asymmetric.com/blog/under-the-hood/ Wed, 24 Jun 2026 00:00:00 GMT Fuzzing Commonware isn't a pile of one-off harnesses. It's engineered: deterministic runtime, controlled randomness, reviewable fuzz targets, reproducible crashes, promoted regressions. https://asymmetric.com/blog/all-roads-lead-to-panic-a-starknet-oracle-story/ https://asymmetric.com/blog/all-roads-lead-to-panic-a-starknet-oracle-story/ Tue, 02 Jun 2026 00:00:00 GMT Pragma is one of Starknet's main oracles, pricing collateral and liquidations for lending protocols holding tens of millions on-chain. This post explains how a missing access-control check could have let anyone disable its core price feeds for a few cents. https://asymmetric.com/blog/across-solana-event-spoofing/ https://asymmetric.com/blog/across-solana-event-spoofing/ Wed, 22 Apr 2026 00:00:00 GMT On Solana, events are often reconstructed from transaction traces, and failed transactions still emit data. This bug in Across could have allowed attackers to spoof deposit events and trick relayers into filling orders with no real deposit behind them. https://asymmetric.com/blog/solana-p-token-catching-a-bug-before-mainnet/ https://asymmetric.com/blog/solana-p-token-catching-a-bug-before-mainnet/ Wed, 15 Apr 2026 00:00:00 GMT CU optimizations come with risks. This post details a critical bug we found in p-token before mainnet, subtle enough to survive in a heavily scrutinized codebase. https://asymmetric.com/blog/understanding-agents-code-coverage-for-coding-agents/ https://asymmetric.com/blog/understanding-agents-code-coverage-for-coding-agents/ Thu, 09 Apr 2026 00:00:00 GMT When an agent audits your codebase, a common question is: what did it actually read and with what intent? Current tools don't answer that. We built a prototype and open-sourced it. https://asymmetric.com/blog/solana-vulnerabilities-that-arent-unpacking-common-misreports/ https://asymmetric.com/blog/solana-vulnerabilities-that-arent-unpacking-common-misreports/ Thu, 12 Mar 2026 00:00:00 GMT The most persistent security misinformation doesn't come from obscure corners of the internet, but from official docs, learning resources, and popular LLMs. Learn about the Solana vulnerabilities that aren't, and why they keep spreading. https://asymmetric.com/blog/wrong-offset-bypassing-signature-verification-in-relay/ https://asymmetric.com/blog/wrong-offset-bypassing-signature-verification-in-relay/ Mon, 22 Sep 2025 00:00:00 GMT Relay Protocol's contracts trusted Ed25519 verification without validating offsets, opening the door to forged allocator signatures and potential double-spends. Learn about the bug, the risks it posed to cross-chain liquidity, and how the issue was addressed. https://asymmetric.com/blog/threat-contained-marginfi-flash-loan-vulnerability/ https://asymmetric.com/blog/threat-contained-marginfi-flash-loan-vulnerability/ Wed, 17 Sep 2025 00:00:00 GMT A new instruction broke the flash loan logic, creating a way to borrow without repaying and putting $160M at risk. We explain the vulnerability, potential impact, and how it was fixed. https://asymmetric.com/blog/threat-contained-behind-the-scenes-of-a-blocked-phishing-attempt/ https://asymmetric.com/blog/threat-contained-behind-the-scenes-of-a-blocked-phishing-attempt/ Tue, 01 Jul 2025 00:00:00 GMT An attacker posing as a well-known web3 founder messaged one of our engineers via Telegram. Rather than ignoring the attempt, we isolated and analyzed the payload in a controlled environment, turning a live phishing attempt into a learning opportunity. https://asymmetric.com/blog/boredom-over-beauty-why-code-quality-is-code-security/ https://asymmetric.com/blog/boredom-over-beauty-why-code-quality-is-code-security/ Tue, 03 Jun 2025 00:00:00 GMT Some of the most devastating vulnerabilities stem from complexity, inconsistency, and chaos. This post explains why predictable, well-formed code is the foundation of security. https://asymmetric.com/blog/finding-fractures-an-intro-to-differential-fuzzing-in-rust/ https://asymmetric.com/blog/finding-fractures-an-intro-to-differential-fuzzing-in-rust/ Thu, 15 May 2025 00:00:00 GMT In the year 2050, a malformed JSON input lead to the complete shutdown of the Replicant P2P network. Today, we'll reproduce this bug class in ~100 lines of code. https://asymmetric.com/blog/invocation-security-navigating-vulnerabilities-in-solana-cpis/ https://asymmetric.com/blog/invocation-security-navigating-vulnerabilities-in-solana-cpis/ Wed, 23 Apr 2025 00:00:00 GMT Cross-program invocation (CPI) is the mechanism on Solana through which one program calls another. It's used for system instruction calls, SPL token transfers, custom program execution, and even event emissions, making it a core part of writing functional programs in Solana. https://asymmetric.com/blog/corrupt-commitments-proposer-equivocation-bug-in-helix-mev-relay/ https://asymmetric.com/blog/corrupt-commitments-proposer-equivocation-bug-in-helix-mev-relay/ Fri, 06 Dec 2024 00:00:00 GMT This blogpost details a vulnerability identified in Titan's Helix MEV Relay which could be abused by trusted proposers to perform equivocation attacks, during which private transaction information is prematurely revealed, leading to potential transaction reordering. https://asymmetric.com/blog/ghost-in-the-block-ethereum-consensus-vulnerability/ https://asymmetric.com/blog/ghost-in-the-block-ethereum-consensus-vulnerability/ Thu, 19 Sep 2024 00:00:00 GMT In this blog post, we will show how a small difference in SSZ deserialization between the Prysm and Lighthouse clients could have allowed an attacker to severely degrade Ethereum consensus. https://asymmetric.com/blog/circles-cctp-noble-mint-bug/ https://asymmetric.com/blog/circles-cctp-noble-mint-bug/ Tue, 27 Aug 2024 00:00:00 GMT We privately disclosed a vulnerability to Circle via their bug bounty program. The vulnerability could have been exploited by circumventing the CCTP message sender verification process to mint fake USDC tokens on Noble. https://asymmetric.com/blog/evmos-precompile-state-commit-infinite-mint/ https://asymmetric.com/blog/evmos-precompile-state-commit-infinite-mint/ Thu, 01 Aug 2024 00:00:00 GMT This post details a vulnerability we identified in Evmos, an EVM-compatible Cosmos chain, that could have been exploited to mint infinite amounts of $EVMOS tokens. Due to EVM state commits during precompile execution, it could cause a mismatch between the state held within EVM and the Bank module. https://asymmetric.com/blog/cosmos-ibc-reentrancy-infinite-mint/ https://asymmetric.com/blog/cosmos-ibc-reentrancy-infinite-mint/ Tue, 16 Apr 2024 00:00:00 GMT This post discusses a vulnerability in ibc-go, a reference implementation of the Cosmos Inter-Blockchain Communication (IBC) protocol. A reentrancy vulnerability during the handling of timeout messages could have allowed an attacker to mint an infinite amount of IBC tokens on affected Cosmos chains. https://asymmetric.com/blog/polygon-log-confusion/ https://asymmetric.com/blog/polygon-log-confusion/ Thu, 08 Feb 2024 00:00:00 GMT In this post, we describe a vulnerability in Heimdall, the validator software of the Polygon Proof-of-Stake (PoS) blockchain. This flaw, if exploited, could have allowed a rogue/compromised validator to take over the Heimdall consensus layer and inject fraudulent events into the StakeSync mechanism.