Field notes from the offensive side.
Deep-dives on smart contract audits, DeFi exploits, red teaming, cloud and AI security — written by the team that breaks things for a living.
The 2026 Smart Contract Audit Checklist
The full checklist our auditors run on every Solidity and Rust engagement — what we look for, why each item keeps appearing in post-mortems, and how to prepare your codebase before we touch it.
Read article
DeFi Exploit Patterns You Will See Again
The exploit mechanisms that recur across DeFi protocols: oracle manipulation, reentrancy, share inflation, access control, governance and composability, with the pre-conditions and the defence for each.
Read article
How Cross-Chain Bridges Get Drained
Every bridge drain is an attack on the mechanism that tells the destination chain a lock happened. We cover bridge designs, signer compromise, proof verification bugs, replay, rate limits and the invariant to monitor.
Read article
Security Pitfalls in Zero-Knowledge Circuits
Where ZK circuits break: under-constrained signals, missing range checks, Fiat–Shamir transcript gaps, public input aliasing, verifier contract bugs and trusted setups, with the tests that find them.
Read article
Securing ERC-4337 Smart Accounts
Under ERC-4337, authorisation is whatever validateUserOp accepts. We cover the UserOperation lifecycle, validation rules, paymaster griefing, session keys, factories, modules, recovery and EIP-7702.
Read article
Cloud IAM Misconfigurations That Lead to Breaches
Most cloud breaches are decided in the identity layer, not the network. We walk through the IAM misconfigurations that turn one credential into full account compromise, and how we test for each.
Read article
Prompt Injection and Securing AI Agents
Prompt injection is not a bug you can patch — it is how language models work. We explain the mechanism, the exfiltration paths through tools and rendered output, and the design that contains it.
Read articleUsing LLMs in Offensive Security — Carefully
Language models help with the high-volume parts of offensive security and hurt when trusted with judgement. The real risk, though, is the data-handling trap — and it catches firms who should know better.
Read article
NIS2 and DORA: What EU Companies Must Do Now
NIS2 and DORA have turned security into a supervised obligation with named deadlines and personal liability for the board. We explain what each requires, where the dates stand, and how testing maps onto the rules.
Read articleSecuring Your Software Supply Chain
You can write perfect code and still ship a backdoor. We walk through the two soft targets — your dependencies and your build system — and the pinning, provenance and isolation that actually defend them.
Read articleAuditing Rust Smart Contracts on Solana
On Solana every account is a caller-supplied parameter. We cover the checks that go missing: owner, signer, type, PDA seeds and bumps, CPI targets, reinitialisation, revival, duplicates, sysvars and upgrade authority.
Read articleThe MEV Threat Model for Protocol Designers
MEV is a property of your mechanism design, not a bug to patch. How sandwiches, liquidation races, JIT liquidity and oracle front-running work, and how to design so that ordering is worth less.
Read article
Wallet Drainers and Phishing-as-a-Service
Drainers do not steal keys; they get users to sign one message they did not read. The full kill chain, the signature types abused, the rental economics behind the kits, and what teams can do.
Read articleKey Management for Protocols: Multisig, MPC, and HSMs
The cheapest path to a treasury usually runs through an admin key, not a contract bug. How to design multisig thresholds, use MPC and hardware well, defeat blind signing, and rehearse rotation.
Read article
Incident Response: The First 24 Hours After a Hack
An hour-by-hour guide to the first day after an exploit: pause decisions, war-room roles, evidence, fund tracing and freezes, negotiating with the attacker, communication, recovery and the post-mortem.
Read articleWhen Formal Verification Is Worth It
Formal verification proves a property of a model under assumptions. When that is worth the cost, which invariants to prove, why the specification is the risk, and when fuzzing gives most of the value.
Read articleSecuring Oracles and Price Feeds
How on-chain price sources are manipulated, the validation layer every oracle read needs, and how our auditors test the path from external data to state change.
Read articleWeb3 Front-End Security: The Overlooked Attack Surface
Audited contracts do not protect users from a hijacked domain, a poisoned dependency or a swapped contract address. How dApp front-ends are attacked, and the defences that change the outcome.
Read articlePost-Quantum Cryptography: Should You Care in 2026?
Which cryptography breaks, which survives, what NIST has standardised, and a proportionate plan for enterprises and blockchain teams — without panic migration or complacency.
Read articleRed Teaming vs Penetration Testing: What You Actually Need
Pentests find what is broken; red teams find whether you would notice. Precise definitions, cost drivers, deliverables, compliance drivers and a decision guide by maturity.
Read article