Security research, vulnerability deep-dives, and smart contract audit guides.
A practical guide to interpreting smart contract audit reports — what severity levels mean, how to prioritize findings, what auditors often miss, and how to verify fixes.
Six critical vulnerabilities that arise when deleting Solidity mappings and structs with nested mappings, leaving ghost state that attackers can exploit for double claims, privilege escalation, and cross-upgrade data leakage.
Explore how token blacklists are bypassed through intermediary contracts, pre-transfer hooks, and upgrade attacks. Learn secure blocklist implementation patterns for compliance-critical tokens.
Prevent block.timestamp manipulation in Solidity. Master 6 secure design patterns for Ethereum L1 and L2 rollups including Arbitrum and Optimism.
Flash loans enable zero-capital attacks that would require millions of dollars of starting capital otherwise. Six attack patterns — price manipulation, collateral inflation, governance hijacking, arbitrage exploitation, and oracle attacks — with protocol-level mitigations.
Cross-chain bridges have lost over $2.5 billion to exploits. This post dissects six vulnerability classes — validator set manipulation, message replay, fraudulent proofs, unlimited minting, access control failures — with Solidity patterns and mitigations.
Six critical Chainlink oracle vulnerabilities — from stale prices and sequencer downtime to decimal mismatches and missing fallbacks — with vulnerable code, fixes, and detection tips.
An in-depth analysis of six critical security vulnerabilities in ERC-4337 account abstraction: signature replay, paymaster griefing, nonce bypass, TOCTOU allowlist flaws, entryPoint trust assumptions, and initCode front-running.
selfdestruct forces ETH into contracts that assume their balance is only modified via payable functions. This breaks balance-based invariants. Post-Cancun EIP-6780 changes the semantics. Six vulnerability classes with safe balance accounting patterns.
Pause mechanisms are meant to be emergency circuit breakers, but misconfigured pausable contracts become attack surfaces themselves. This guide covers six critical vulnerabilities — from single-key pause authority to griefing via rapid cycling — with vulnerable and secure Solidity code examples.
Hardcoded addresses, incorrect immutable initialization, and constants that should be configurable are a persistent source of bugs. Six vulnerability classes — hardcoded mainnet addresses on wrong chain, immutable set in wrong constructor, magic numbers without explanation.
Protocols that accept both ETH and WETH create dual code paths with subtle security differences. Six vulnerability classes — ETH/WETH accounting mismatch, unwrap reentrancy, msg.value in loops, WETH balance checks, and more — with safe integration patterns.
ERC-1155 enables batch operations across thousands of token IDs, but its callback-heavy design creates reentrancy vectors and state management risks that don't exist in ERC-20 or ERC-721. This post covers seven critical vulnerabilities unique to the multi-token standard.
Why approve(MAX_UINT256) is dangerous, how infinite token approvals have enabled hundreds of millions in losses, and the contract-level patterns that make approvals safer.
Six vulnerabilities that drain staking contracts — flash loan reward capture, integer rounding dust, missing updateReward guards, ERC-777 reentrancy, share inflation on first deposit, and admin drain via notifyRewardAmount. With vulnerable code, secure fixes, and what ContractScan detects automatically.
A deep-dive into six AMM & DEX vulnerabilities in Solidity, including spot price oracle abuse, sandwich attacks, and reentrancy with secure code fixes.
MythX is gone. The security tooling landscape is shifting toward multi-engine scanning, AI-powered analysis, and developer workflow integration. Here's what's changing and what ContractScan is building next.
Access control vulnerabilities rank #1 in smart contract losses as of 2025. Analyzing Poly Network, Ronin Bridge, and Nomad Bridge exploits with OZ v5 defenses.