The log.
Security notes, post-mortems, and observations from the audit floor.
Semgrep for Solidity: Custom Rules for Audit Workflows
Semgrep is not a vulnerability scanner — it is a pattern matcher. In an audit workflow, it excels at finding every instance of a specific pattern across a large codebase in seconds. Writing the right rules is what makes it useful.
Groth16 vs PLONK vs STARKs: Security Trade-offs for Protocol Designers
The choice of proof system is a security decision. Trusted setup requirements, cryptographic assumptions, quantum resistance, and verification costs differ materially between Groth16, PLONK, and STARKs.
ERC-4337 Account Abstraction Security: Paymasters, Bundlers, and UserOp Validation
Account abstraction separates validation from execution and introduces Bundlers and Paymasters as new trust boundaries. Each boundary is an attack surface. The ERC-4337 security model requires understanding all of them.
MEV and Front-Running: What an Audit Actually Looks For
Maximal extractable value is not a bug — it is a property of public blockchains. But specific protocol design choices create extraction opportunities that were not intended by the designers. These are the ones auditors flag.
Tokenomics Audit: When the Math Is the Vulnerability
Some vulnerabilities live in the economic design, not the code. An emission schedule that can be front-run, a vesting cliff that can be bypassed, a reflexive design that collapses under selling pressure — these require economic analysis, not just code review.
Trusted Setup Ceremonies: What Can Go Wrong
A compromised trusted setup allows the generation of valid proofs for false statements — silently, undetectably, forever. Understanding what ceremonies actually guarantee is essential for any team building on a setup-dependent proof system.
Airdrop and Merkle Distribution Security: Proof Manipulation and Double Claims
A Merkle distribution looks simple. The root is on-chain, the proofs are off-chain, claims are verified on submission. The attack surfaces are in the leaf encoding, the claim tracking, and the assumptions about who controls the tree.
Aptos Smart Contract Security: Move VM, Resources, and Ownership Model
Move's linear type system prevents entire classes of EVM vulnerabilities at the language level. The vulnerabilities that remain — resource leaks, signer capability abuse, entry function access control — require a different audit approach.
Signature Replay Attacks: Why Off-Chain Signatures Are Hard to Get Right
A valid signature from the right signer, used in the wrong context, is an exploit. Chain ID, nonce, contract address, expiry — every missing component of a signature domain is an attack surface.
Vesting and Cliff Contracts: Time Manipulation and Beneficiary Confusion
Vesting contracts hold significant value for extended periods. Timestamp dependence, beneficiary address management, revocation access control, and interactions with governance systems each create exploitable surfaces.