The log.
Security notes, post-mortems, and observations from the audit floor.
Smart Contract Audit: The Complete Guide
What an audit covers, how it works, what to expect, and how to use the results. Everything a protocol team needs to know before, during, and after an engagement.
Storage Collision in Proxies: Slot Conflicts and Uninitialized Variables
Storage collisions are silent. Two variables occupy the same slot, writes to one corrupt the other, and the contract continues executing as if nothing happened — until the consequences become impossible to ignore.
How Much Does a Smart Contract Audit Cost?
Audit pricing is driven by scope, complexity, and timeline — not by a fixed rate card. Understanding what goes into the number helps you budget accurately and avoid surprises.
Calldata Manipulation: ABI Encoding Edge Cases and Decoder Bugs
ABI encoding is not as rigid as it appears. Dirty bits, offset manipulation, and encoding edge cases allow calldata to be crafted in ways that decoders interpret differently — opening gaps between what was signed and what was executed.
How to Choose a Smart Contract Auditing Firm
The audit market has no standardized credentials and wide quality variance. Evaluating firms on the right criteria — methodology, report quality, remediation support — matters more than reputation alone.
ERC-777 and Callback Vulnerabilities: The Token Standard That Bites Back
ERC-777 is ERC-20 compatible — which means a protocol that only supports ERC-20 will accept ERC-777 tokens without knowing it. The tokensReceived hook fires on every transfer, re-entering your contract before your state is committed.
Static Analysis vs Fuzzing vs Formal Verification: What Each Finds
Each technique explores a different part of the vulnerability space. Static analysis finds known patterns. Fuzzing finds unexpected state. Formal verification proves properties. Used together, they cover more ground than any one alone.
Reentrancy: Every Variant, Every Pattern
Single-function, cross-function, cross-contract, read-only. Reentrancy is not one vulnerability — it is a family. Each variant requires a different detection strategy and a different fix.
Donation Attacks and Forced Ether: When ETH Balance Breaks Your Logic
Any contract can receive ETH against its will via selfdestruct. If your logic depends on address(this).balance being within expected bounds, that assumption can be broken by anyone with enough ETH and a willingness to spend it.
Arbitrum Security: What Changes When You Audit on L2
Arbitrum is not Ethereum. The sequencer, retryable tickets, block number semantics, and L1-L2 message passing each introduce assumptions that contracts must handle explicitly to be secure.