Security research

Security Research.

Public write-ups on the bugs, patterns, and protocols we audit. Engineer-to-engineer, no fluff.

Filter
Showing 12 of 133

All research.

OWASP ASI01 Explained: AI Agent Goal Hijacking
Adversarial & AI SecurityJun 2, 2026·12 min

OWASP ASI01 Explained: AI Agent Goal Hijacking

OWASP ASI01 (Agent Goal Hijack) explained: how prompt injection redirects AI agent objectives. Direct, indirect, and tool-mediated patterns with mitigations.

Read
Agentic DeFi security: when AI agents control treasury, trading, and liquidations
Adversarial & AI SecurityJun 1, 2026·21 min

Agentic DeFi security: when AI agents control treasury, trading, and liquidations

AI agents now autonomously control DeFi treasuries, execute trades, and trigger liquidations. The cross-layer attack surface that contract audits cannot see.

Read
How to Build Compound V2 From Scratch (18 Sections, Line by Line)
DeFi Protocol AnalysisMay 28, 2026·13 min

How to Build Compound V2 From Scratch (18 Sections, Line by Line)

Rebuild Compound V2 from scratch — cTokens, Comptroller, InterestRateModel, and liquidation logic. The second-most-forked DeFi protocol, understood end to end.

Read
Long-Lived Agents: Delayed Execution Risk
Adversarial & AI SecurityMay 27, 2026·14 min

Long-Lived Agents: Delayed Execution Risk

Why long-lived AI agents fail across time, not just prompts. Practical audit checks for delayed execution, stale approvals, and memory-driven authority drift.

Read
OWASP ASI05 Explained: AI Agent RCE Patterns
Adversarial & AI SecurityMay 26, 2026·12 min

OWASP ASI05 Explained: AI Agent RCE Patterns

OWASP ASI05 (Unexpected Code Execution) explained: how agent-generated code and tool composition produce RCE in agentic systems. Real CVEs and mitigations.

Read
Why Learning Web3 by Building Beats Watching Videos
Zealynx NewsMay 25, 2026·12 min

Why Learning Web3 by Building Beats Watching Videos

Most Web3 education is video-heavy. Research shows active construction of knowledge produces meaningful skill faster than passive consumption. Here's why build-first platforms matter.

Read
What Happens During a Smart Contract Audit: Week-by-Week Process
Audit OperationsMay 25, 2026·17 min

What Happens During a Smart Contract Audit: Week-by-Week Process

A senior auditor walks through what actually happens during a smart contract audit, week by week. Pre-audit prep, manual review, findings, fix verification, and final deliverables.

Read
Uniswap v4 hook attacks: 4 exploit patterns with PoCs
DeFi Protocol AnalysisMay 25, 2026·25 min

Uniswap v4 hook attacks: 4 exploit patterns with PoCs

The four Uniswap v4 hook attack patterns that cover every public exploit: reentrancy, flag bypass, donation griefing, accounting drift — with minimal PoCs.

Read
Cursor IDE MCP CVEs: MCPoison & CurXecute Explained
Adversarial & AI SecurityMay 22, 2026·11 min

Cursor IDE MCP CVEs: MCPoison & CurXecute Explained

CVE-2025-54136 (MCPoison) and CVE-2025-54135 (CurXecute): tool descriptor injection and workspace-file-write RCE in Cursor IDE's MCP layer. Mechanism, impact, fixes.

Read
The Web2 blind spot: Why audited smart contracts get hacked
Adversarial & AI SecurityMay 22, 2026·27 min

The Web2 blind spot: Why audited smart contracts get hacked

Bybit, BadgerDAO, Curve — all audited, all drained off-chain. How DNS hijacks, CDN compromises, and signing-flow attacks bypass smart contract audits.

Read
Zealynx Academy vs Cyfrin Updraft, Alchemy University, and LearnWeb3: Honest Comparison
May 21, 2026·13 min

Zealynx Academy vs Cyfrin Updraft, Alchemy University, and LearnWeb3: Honest Comparison

Honest comparison of Web3 education platforms: Zealynx Academy, Cyfrin Updraft, Alchemy University, LearnWeb3, and CryptoZombies. Pick the right one for your stage and goals.

Read
AI Agent Outbound Authority: Audit Checks
Adversarial & AI SecurityMay 20, 2026·13 min

AI Agent Outbound Authority: Audit Checks

Why email, messaging, and webhook tools need destination-level controls in AI agents. Practical audit checks for exfiltration and approval bypass.

Read