Glossary
All things DeFi and security in plain English. Our glossary breaks down complex terms and concepts into relatable language, making it easier for you to grasp the essentials of blockchain security.
All Terms
A
Abstract Syntax Tree
A hierarchical tree representation of source code structure used by compilers and static analysis tools to understand and analyze programs.
Access Control
Security mechanisms that restrict which addresses can call specific functions in a smart contract, preventing unauthorized actions.
ACT Vulnerability
The Approved Controllable TransferFrom exploit where attackers bypass compliance wrappers by routing tokens through approved spenders that skip sender verification checks.
Active Liquidity
Liquidity within a position's price range that is currently being used for trades and earning fees.
Address Mining
Process of finding a contract deployment address with specific properties using CREATE2, used in Uniswap v4 to configure hook permissions.
Aderyn
An open-source Rust-based static analyzer for Solidity smart contracts that helps detect vulnerabilities before deployment.
Adversarial Input
Carefully crafted input designed to cause AI models to make incorrect predictions or exhibit unintended behavior.
Agentic AI
AI systems that autonomously take actions in the real world, including executing commands, managing files, and interacting with external services.
AI Hallucination
When AI systems generate false or nonsensical information presented as factual, lacking grounding in training data.
AI Red Teaming
Adversarial testing methodology that evaluates AI systems for security vulnerabilities, manipulation techniques, and misuse potential through realistic attack simulation.
Algorithmic Stablecoin
A cryptocurrency designed to maintain a stable price through automated supply adjustments rather than collateral backing.
Allowance
An ERC20 mechanism that permits a third party to spend tokens on behalf of the token owner, up to a specified limit.
Amplification Coefficient
Configurable parameter in StableSwap controlling curve shape by dictating liquidity concentration around equilibrium for pegged assets.
Anchor Framework
The standard development framework for Solana programs that provides declarative security constraints, automatic account validation, and serialization through Rust macros.
Arbitrage
Trading strategy exploiting price differences between markets to profit while rebalancing pools to market prices.
Architectural Decomposition
Security methodology isolating system into distinct components (vault, logic, oracle, governance) to verify local invariants before compositional analysis.
Asset Duplication Attack
Exploit where players can create multiple copies of valuable in-game NFTs or tokens through contract vulnerabilities, state desynchronization, or race conditions.
Asset-Referenced Tokens (ARTs)
Crypto-assets that maintain stable value by referencing a basket of assets (currencies, commodities, or other crypto-assets), subject to MiCA's most stringent reserve and operational requirements.
Asynchronous Settlement
Request/claim pattern separating user intent from execution, enabling off-chain T+2 settlement cycles within blockchain transactions.
Attack Surface
The total number of points where unauthorized users can try to enter data or extract data from an environment, including AI-specific entry points and interactions.
Attention Mechanism
A neural network component that enables models to focus on relevant parts of input data, forming the foundation of modern LLMs and AI systems.
Audit Scope
The defined boundaries of a security audit, specifying which contracts, functions, and concerns will be reviewed.
Automated Market Maker (AMM)
A decentralized exchange protocol that uses mathematical formulas to price assets instead of order books.
B
Backpropagation
The algorithm that enables neural networks to learn by computing how much each weight contributed to prediction errors and adjusting accordingly.
BalanceDelta
A struct in Uniswap v4 that represents the net change in token balances resulting from pool operations like swaps or liquidity modifications.
Blind Signing
The practice of approving blockchain transactions based on UI display without verifying the underlying transaction data.
Bonding Curve
A mathematical function that defines the relationship between a token's price and its supply, enabling automated price discovery.
Boosted Pool
Liquidity pool routing idle capital to external yield protocols while maintaining swap liquidity through buffer reserves.
Borsh
Binary Object Representation Serializer for Hashing, a deterministic serialization format used by Solana for encoding and decoding on-chain account data.
Bug Bounty
Reward program incentivizing security researchers to find and report vulnerabilities before malicious exploitation.
Bump Seed Canonicalization
The practice of using the first valid bump seed found during PDA derivation to ensure a single canonical address per seed set, preventing duplicate account attacks.
Bytecode
Compiled low-level instructions executed by the Ethereum Virtual Machine, produced from Solidity or other high-level languages.
Byzantine Fault Tolerance
The ability of a distributed system to continue functioning correctly even when some participants act maliciously or fail arbitrarily.
C
Cap Table
Capitalization table recording all token holders, their share classes, and ownership percentages for corporate governance and compliance.
Capital Efficiency
Measure of how effectively liquidity generates fees relative to capital deployed, improved by concentrated liquidity.
Chainlink
The leading decentralized oracle network providing secure, tamper-proof data feeds for smart contracts.
Checks-Effects-Interactions
Solidity security pattern ordering operations to validate inputs, update state, then make external calls preventing reentrancy vulnerabilities.
Circuit Breaker
An emergency mechanism that automatically or manually halts protocol operations when anomalous conditions are detected.
Clearinghouse
Exchange component that updates balances, positions, margin, and PnL after trades and triggers liquidations when risk thresholds are breached.
CLOB
Central Limit Order Book matching buy and sell orders by price-time priority enabling traditional exchange trading mechanics on-chain.
Cloud Misconfiguration
Incorrectly set permissions on cloud infrastructure (e.g., public S3 buckets) that expose sensitive data, API keys, or admin credentials.
Competitive Audit
Public security review where multiple auditors compete to find vulnerabilities with rewards based on severity and discovery priority.
Compliance Hook
A _beforeTokenTransfer override pattern that intercepts every token state change to enforce identity verification and regulatory rules at the moment of transfer.
Concentrated Liquidity
A liquidity provision model where LPs can specify custom price ranges for their capital.
Constant Product Formula
The mathematical formula (x · y = k) that governs automated market makers, maintaining a constant product of token reserves.
Content Security Policy (CSP)
HTTP response header that restricts which scripts, styles, and resources can load in a browser, mitigating XSS and code injection attacks.
Context Manipulation
Technique where attackers alter or poison the context window of AI systems to influence decision-making or extract sensitive information.
Context Window
The maximum amount of text (measured in tokens) that an LLM can process in a single interaction, defining its working memory limits.
Controller Role
ERC-1644 privileged address with forced transfer capability for legal compliance scenarios like court orders or lost key recovery.
Core/Periphery Architecture
A design pattern separating immutable fund-holding contracts (core) from upgradeable user-facing contracts (periphery).
Cross-Chain
Technology enabling interoperability and asset transfers between different blockchain networks.
Cross-Site Request Forgery (CSRF)
An attack that tricks authenticated users into executing unwanted actions on a web application where they're logged in.
Cross-Site Scripting (XSS)
A web vulnerability where attackers inject malicious scripts into web applications, enabling theft of user data or unauthorized actions.
CryptoSwap
Curve v2 invariant for volatile uncorrelated assets featuring dynamic re-pegging to concentrate liquidity around current market prices.
D
Data Exfiltration
Unauthorized transfer of data from a system to an external destination controlled by an attacker, often performed covertly to avoid detection.
Defense in Depth
Layered security strategy combining multiple independent protections rather than relying on single security measures.
Delegatecall
EVM opcode that executes another contract's code in the calling contract's storage context, enabling proxy patterns and code reuse.
Diamond Standard
EIP-2535 proxy pattern allowing a single contract to delegate calls to multiple implementation contracts (facets).
DNS Hijacking
An attack that modifies DNS records to redirect users from legitimate websites to malicious phishing pages controlled by the attacker.
DNSSEC
DNS Security Extensions that cryptographically sign DNS records to prevent unauthorized modifications and hijacking attacks.
Duty of Care
Legal obligation requiring smart contract developers to meet industry security standards to avoid negligence liability.
E
Echidna
A property-based fuzzer for Ethereum smart contracts that uses grammar-based input generation to find violations of user-defined invariants.
Economic Exploit
Attack vector exploiting protocol economic logic and incentive mechanisms rather than traditional code vulnerabilities.
Edge Case
An unusual or extreme input condition that occurs at the boundaries of expected behavior, often revealing vulnerabilities in smart contracts.
EIP-4788
An Ethereum protocol upgrade that exposes the beacon chain block root inside the EVM, enabling trustless validator state verification.
EIP-712
Ethereum standard for structured data hashing and signing enabling human-readable transaction signatures with domain separation.
Electronic Money Tokens (EMTs)
Crypto-assets that maintain stable value by referencing a single official currency (e.g., EUR or USD), regulated under MiCA as digital equivalents of electronic money.
Embedding
A dense vector representation of data (text, images, code) in a continuous mathematical space where similar items are positioned near each other.
Entropy (AI)
A measure of uncertainty or randomness in AI predictions, indicating how confident or confused a model is about its outputs.
EOA (Externally Owned Account)
A blockchain account controlled by a private key held by a person or entity, as opposed to a contract account controlled by code.
Epoch-Based Batching
Settlement pattern collecting requests over a time period and processing all at the same NAV, ensuring fairness and preventing front-running.
ERC-2981
Ethereum standard for signaling royalty payment information on NFT sales, providing a universal royaltyInfo interface.
ERC-3643
A token standard for permissioned security tokens that integrates identity verification and compliance checks directly into transfer logic.
ERC-4626
Tokenized vault standard providing a unified API for yield-bearing vaults with deposit, withdrawal, and accounting functions.
ERC-6909
Minimal Multi-Token Interface standard used in Uniswap v4 for gas-efficient token accounting.
EVM (Ethereum Virtual Machine)
The runtime environment for executing smart contract bytecode on Ethereum and compatible blockchains.
Exact Input Swap
A swap type where the user specifies exactly how much of the input token to spend, receiving whatever amount of output token the market provides.
Exact Output Swap
A swap type where the user specifies exactly how much of the output token to receive, paying whatever amount of input token the market requires.
Exogenous Liquidity
Assets residing outside the EVM in off-chain systems like brokerage accounts, bank ledgers (Fedwire/SWIFT), or KYC registries.
Exponential Moving Average (EMA)
A weighted moving average that gives exponentially decreasing weight to older observations, making it more responsive to recent data.
F
Facet
Modular logic contracts in the Diamond Standard that contain specific functionality accessed through the diamond proxy.
Factory Contract
A smart contract that deploys and manages exchange contracts, serving as a registry for decentralized exchange pools.
Fee Tiers
Multiple fee levels (0.05%, 0.30%, 1.00%) per token pair in Uniswap v3 to accommodate different risk profiles.
Fee-on-Transfer Tokens
ERC20 tokens that deduct a fee during transfers, causing integration issues with protocols that assume full amounts are received.
Fiat On-Ramp
Service or mechanism enabling users to convert traditional currency into cryptocurrency for blockchain transactions.
Firedancer
High-performance Solana validator client that moves the network's performance limit to the hardware layer, enabling dynamic block sizing and multi-client consensus.
Flash Accounting
A gas optimization technique that tracks balance deltas during a transaction and only settles the final net amount.
Flash Loan
Uncollateralized loan borrowed and repaid within a single transaction, often used for arbitrage or attacks.
Flash Swaps
A Uniswap v2 feature allowing users to borrow any amount of tokens at no upfront cost, perform arbitrary actions, and repay within the same transaction.
Forced Transfer
Administrative capability allowing issuers or controllers to move security tokens without the holder's private key, required for regulatory compliance and legal enforcement.
Formal Verification
Mathematical proof technique using symbolic logic to verify smart contract invariants cannot be violated under any conditions.
Forward Pricing
Exchange rate determination at fulfillment time rather than request time, preventing arbitrage from stale NAV data in asynchronous vaults.
Foundry
Fast, portable Ethereum development framework written in Rust, featuring advanced testing and debugging capabilities.
Front-running
The practice of observing pending transactions and submitting similar transactions with higher gas fees to execute first, extracting value.
Frontend Security
Security practices protecting web application client-side code from attacks like XSS, CSRF, and malicious script injection.
Funding Rate
Periodic payment between long and short positions in perpetual contracts anchoring derivative prices to underlying spot markets.
Fuzzing
Automated testing technique using randomly generated inputs to discover edge cases and vulnerabilities in smart contracts.
G
Gaming Oracle Manipulation
Attacks targeting price feeds and external data sources used for in-game asset valuation, leaderboards, and game mechanics to gain unfair advantages.
Gas
A unit measuring computational effort required to execute operations on Ethereum, paid by users to incentivize validators.
Gas Optimization
Code efficiency improvements reducing transaction execution costs by minimizing computational operations and storage access on the blockchain.
Gradient Descent
An optimization algorithm that iteratively adjusts model parameters in the direction that reduces prediction errors.
Graph Neural Network
A neural network architecture designed to operate on graph-structured data, learning representations that capture node relationships and graph topology.
H
Halmos
A symbolic testing tool for Ethereum smart contracts that runs Foundry tests with symbolic inputs to prove properties hold for all possible values.
Hardhat
A popular Ethereum development environment for compiling, deploying, testing, and debugging smart contracts.
Hardware Wallet
A physical device that stores cryptocurrency private keys offline, providing enhanced security against remote attacks.
Hooks
External smart contracts in Uniswap v4 that execute custom logic at specific points in a pool's lifecycle.
HyperBFT
Hyperliquid's HotStuff-inspired BFT consensus layer that finalizes the L1 block sequence with fast finality and no reorgs.
HyperCore
Hyperliquid's native financial execution engine running spot, perps, risk, and liquidations outside the EVM for deterministic, low-latency trading.
HyperEVM
Permissionless EVM environment on Hyperliquid for smart contracts that observe and extend HyperCore state without affecting the financial core.
Hyperliquidity Provider (HLP)
Protocol-native vault providing liquidity via market-making strategies, participating in liquidations and Earn mechanisms as a system-level actor.
I
Identity Registry
ERC-3643 component acting as source of truth, mapping wallet addresses to verified on-chain identities and enabling compliance checks before transfers.
Impermanent Loss
The temporary loss in value experienced by liquidity providers when the price ratio of deposited assets changes compared to holding them.
Inflation Attack
Vault vulnerability where attackers manipulate share prices by directly donating assets, causing victims to receive fewer shares.
Input Validation
The process of verifying that user-supplied data meets expected formats and constraints before processing, preventing injection attacks and logic errors.
Insecure Direct Object Reference (IDOR)
A vulnerability where applications expose internal object references without proper authorization checks, allowing unauthorized access to data.
Integer Division
Division in Solidity that truncates the result to a whole number, discarding any fractional remainder and potentially causing precision loss.
Invariant
A property or condition that must always hold true throughout a smart contract's execution, used as a basis for testing and formal verification.
Invariant Testing
Property-based testing approach verifying that critical protocol conditions remain true across all possible execution paths.
J
K
KL Divergence
A statistical measure of how different two probability distributions are, used to detect model behavior changes and distribution shifts.
Knowledge Graph
A structured representation of entities and relationships used to enhance AI systems with factual knowledge and reasoning capabilities.
Kontrol
A formal verification tool using the K Framework that provides mathematical proofs of smart contract correctness through symbolic execution.
L
Large EVM Block
Lower-frequency HyperEVM execution block (~1min cadence) intended for heavier transactions like contract deployments.
Lateral Movement
Post-compromise technique where attackers move through a network to access additional systems and resources beyond the initial point of entry.
Legal Oracle
An on-chain verification mechanism that requires a cryptographic proof of a legal instrument (e.g., court order hash) before authorizing privileged administrative actions like forced transfers.
Light Client
A blockchain client that verifies transactions and state without downloading the full blockchain, using cryptographic proofs instead.
Liquidity Bootstrapping Pool
Balancer pool type for token launches where price starts high and gradually decreases for fair price discovery.
Liquidity Gauge
Smart contract where LP tokens are staked to earn CRV rewards with distribution weights determined by veCRV holder voting.
Liquidity Pool
Smart contract holding reserves of two or more tokens that enable decentralized trading without order books.
Liquidity Provider (LP)
A user who deposits assets into a liquidity pool to facilitate trading, earning fees in return.
LLAMMA
Lending-Liquidating AMM Algorithm enabling soft liquidations through continuous gradual collateral conversion rather than discrete liquidation events.
LLM
Large Language Model - AI system trained on vast text data to generate human-like responses and perform language tasks.
LOC Pricing
Audit pricing methodology based on lines of code, typically ranging from $20-50 per line of logic.
Lock-and-Mint
A bridge mechanism where assets are locked on the source chain and equivalent wrapped tokens are minted on the destination chain.
Loss Function
A mathematical function that measures how wrong a model's predictions are, guiding the learning process toward better performance.
LP Token
ERC-20 token representing a liquidity provider's proportional share of a pool's reserves and fees.
M
Maker/Taker Fee
Fee structure where makers add liquidity to order book paying lower fees while takers remove liquidity paying higher fees.
Mark Price
Fair value reference price calculated from spot markets used for unrealized PnL and liquidation calculations preventing manipulation.
Markets in Crypto-Assets (MiCA)
The European Union's comprehensive regulatory framework for crypto-assets, establishing harmonized rules for issuance, trading, and service provision across all 27 EU member states.
Matching Engine
Core system pairing buy and sell orders within exchange ensuring trades execute under consensus without external servers or latency.
Medusa
A parallelized smart contract fuzzer based on Echidna's approach, offering faster execution through concurrent testing across multiple workers.
Mempool
The memory pool where pending transactions wait before being included in a block, visible to all network participants.
Metapool
Curve pool pairing new assets against base pool LP tokens to leverage deep liquidity without fragmenting it across multiple pools.
MEV (Maximal Extractable Value)
Profit extracted by reordering, including, or excluding transactions within a block.
Model Extraction
An attack that reconstructs a proprietary AI model's behavior by querying it repeatedly and training a substitute model on the responses.
Model Inversion
An attack that extracts sensitive information about training data by exploiting what an AI model has learned.
Modifier
Reusable code blocks in Solidity that modify function behavior, commonly used for access control and input validation.
Modular Compliance
Pluggable smart contract architecture allowing regulatory rules (country bans, holder limits) to be updated without redeploying the token contract.
Moving Average
A calculation that smooths price data over a specified period by continuously updating the average as new data arrives.
msg.sender
A Solidity global variable that returns the address of the account or contract that directly called the current function.
Multi-signature Wallet
A cryptocurrency wallet requiring multiple private key signatures to authorize transactions, distributing trust.
N
Naked Redeemer
Security risk where user's shares are burned/locked during redemption request but off-chain settlement fails, leaving user without assets or proof of ownership.
NatSpec
Natural Language Specification Format - Ethereum's standard for documenting smart contract code with structured inline comments.
Neural Network
A computational system inspired by biological brains, consisting of interconnected nodes (neurons) organized in layers that learn patterns from data.
Newton's Method
Iterative root-finding algorithm used on-chain to solve complex invariant equations when direct algebraic solutions are computationally infeasible.
NFT LP Positions
ERC-721 non-fungible tokens representing unique concentrated liquidity positions in Uniswap v3.
NFT State Synchronization
Ensuring consistency between NFT ownership records and game logic state across all smart contracts to prevent asset duplication and desync exploits.
Nonce
A random number used once in cryptographic operations, critical for ECDSA signature security and preventing replay attacks.
O
Off-Chain Injection
Pattern where compliance servers sign permission certificates off-chain that users pass into smart contracts for on-chain validation.
On-Chain Identity
Decentralized identity system (ONCHAINID) based on ERC-734/735 that decouples user identity from wallet addresses, enabling key rotation and portable credentials.
ONCHAINID
Self-sovereign identity contract used in ERC-3643 that links verified legal identities to blockchain wallets, enabling key rotation without re-KYC.
Operational Resilience
The ability of a protocol or service to prevent, withstand, adapt to, and recover from operational disruptions — a core MiCA and DORA requirement covering cybersecurity, business continuity, and ICT risk management.
Optimistic Adjudication
A post-exploit mechanism that crowdsources hack verification using economic game theory to trigger insurance payouts.
Optimistic Transfer
Smart contract pattern sending tokens before verifying payment, relying on post-execution balance checks rather than input validation.
Oracle
A service that provides external data (prices, events, random numbers) to smart contracts that cannot access off-chain information directly.
Overfitting
When an AI model memorizes training data rather than learning general patterns, causing poor performance on new inputs.
Ownable
A common smart contract pattern providing single-address ownership with transfer capabilities, typically used for administrative access control.
P
Parametric Insurance
A DeFi insurance model that uses hard-coded oracle triggers to execute automatic payouts without human claims adjusters.
Partial Fungibility
Token architecture where units within the same contract can have different properties, enabling distinct share classes with separate transfer rules.
Payment Rails
Underlying infrastructure and networks that facilitate transfer of funds between parties in financial transactions.
Permissioned DeFi
Regulated sub-layer on public blockchains where only verified participants can interact, combining institutional compliance with decentralized infrastructure.
Perpetual Futures
Derivative contracts without expiration dates allowing indefinite leveraged positions settled through funding rate mechanisms.
Phishing Attack
A social engineering technique where attackers trick victims into performing unintended actions, such as signing malicious transactions or calling harmful smart contract functions.
Play-to-Earn Tokenomics
Economic model where players earn cryptocurrency tokens through gameplay, requiring careful balance of rewards, token sinks, and inflation control.
Pool Exit
The process of withdrawing liquidity from an AMM pool by redeeming LP tokens for underlying assets.
Pool Manager
The singleton contract in Uniswap v4 that manages all pools, liquidity, and swaps in a unified system.
Precision Loss
Cumulative inaccuracy caused by integer arithmetic and rounding in smart contract calculations.
Price Manipulation
Attacks that artificially move asset prices to exploit protocols relying on those prices for critical operations.
Price Oracle Manipulation
An attack where an attacker artificially skews the price reported by a price oracle to exploit protocols that rely on it.
Private Key
Cryptographic secret that proves ownership and enables spending of cryptocurrency assets on blockchain networks.
Privilege Escalation
Gaining higher access levels than originally granted by exploiting misconfigurations, vulnerabilities, or design flaws in a system.
Proactive Market Maker
DODO's oracle-informed AMM design that concentrates liquidity around external market prices for capital efficiency.
Program Derived Address (PDA)
A deterministic address derived from a combination of seeds and a program ID that falls off the Ed25519 curve, allowing programs to sign transactions without a private key.
Prompt Injection
Attack technique manipulating AI system inputs to bypass safety controls or extract unauthorized information.
Proof of Concept
Demonstration code that proves a vulnerability exists and can be exploited, typically used in security audits and bug bounty submissions.
Proof of Reserve
A verification mechanism that cryptographically proves on-chain token supply is backed by real off-chain or cross-chain assets.
Property-Based Testing
Testing methodology that verifies general properties or invariants hold across randomly generated inputs rather than checking specific hard-coded examples.
Proportional Exit
LP withdrawal method receiving tokens in the pool's current ratio, avoiding swap fees and price impact.
Protocol Fee
Portion of trading, lending, or withdrawal fees retained by the protocol treasury rather than distributed to liquidity providers.
Protocol Solvency
Mathematical guarantee that protocol maintains sufficient reserves to honor all obligations, verified through invariant testing and formal methods.
Proxy Pattern
Smart contract design separating storage and logic, enabling upgrades by changing implementation while preserving state.
Pull Payment
A smart contract payment pattern where recipients withdraw funds themselves, preventing denial-of-service risks from push-based distribution.
R
Race Condition
A vulnerability where the outcome depends on the timing or ordering of events, allowing attackers to exploit the gap between operations.
RAG
Retrieval-Augmented Generation - AI architecture combining language models with external knowledge retrieval systems.
Randomness Manipulation Gaming
Techniques used to predict or influence random outcomes in games for unfair advantage in loot drops, rewards, and chance-based mechanics.
RAROSS
Risk-Adjusted Return on Security Spending—a framework for optimizing the allocation between audit costs and insurance premiums.
Rate Provider
Oracle contract supplying exchange rates for yield-bearing tokens enabling automatic yield accrual to liquidity providers.
Read-Only Reentrancy
Vulnerability where external contracts read inconsistent intermediate state during callback execution before state updates complete.
Real World Asset (RWA)
Physical or traditional financial assets tokenized on blockchain, such as real estate, bonds, or commodities.
Red Teaming
Security testing methodology simulating real-world attacks to identify vulnerabilities before malicious actors exploit them.
Reentrancy Attack
A vulnerability where external calls allow malicious contracts to recursively call back before state updates complete.
Reentrancy Guard
Smart contract security pattern preventing attackers from recursively calling functions to drain funds during execution.
Regression Testing
Testing methodology ensuring that code changes and bug fixes do not introduce new vulnerabilities or break existing functionality.
Regulatory Decentralization
A legal standard where no single entity can be identified as responsible for protocol operations — the threshold for MiCA exemption, distinct from technical decentralization.
Replay Attack
An attack where a valid transaction or message is maliciously resubmitted to execute the same action multiple times.
Ricardian Contract
A legal agreement whose cryptographic hash is stored on-chain, binding enforceable legal prose to smart contract logic.
Role-Based Access Control (RBAC)
An access control pattern where permissions are assigned to roles, and roles are assigned to addresses, enabling granular and flexible authorization.
Rounding Error
Precision loss in mathematical calculations that can be exploited through repeated operations to drain protocol funds.
S
Sandwich Attack
An MEV attack where an attacker front-runs and back-runs a victim's trade to extract profit from the induced price movement.
SDLC
Software Development Life Cycle — the structured process of planning, creating, testing, and deploying software through defined phases.
Sealevel
Solana's parallel transaction processing runtime that enables concurrent execution of non-overlapping transactions by requiring upfront account dependency declaration.
Security Retainer
Ongoing monthly payment arrangement keeping audit firms available for rapid response to protocol updates and security incidents.
Security Tiers
Different levels of security assurance based on audit depth, methodology, and verification techniques employed.
Security Token
Blockchain-based representation of regulated securities (equity, debt, real estate) requiring transfer restrictions and investor verification under securities law.
Self-Custody
Maintaining direct control of cryptocurrency private keys without relying on third-party custodians like exchanges or banks.
Self-Sovereign Identity
A decentralized identity model where users own and control their digital identity independently of any single platform, wallet, or service provider.
Shadow AI
Unauthorized or unmanaged AI tools deployed within enterprise environments without security team awareness or oversight.
Shift Left
Security practice of integrating testing, verification, and security analysis earlier in the software development lifecycle rather than deferring to post-implementation.
Simple Moving Average (SMA)
An average computed by summing values over a fixed number of periods and dividing by that count, giving equal weight to each observation.
Singleton Architecture
A design pattern where all pools are managed within a single unified contract, reducing gas costs.
Singleton Vault
Centralized smart contract architecture managing all token custody and accounting for multiple pools in a single contract.
Slippage
The difference between the expected price of a trade and the actual execution price, caused by market movement or liquidity constraints.
Slither
A popular static analysis tool for Solidity smart contracts, developed by Trail of Bits, that detects vulnerabilities and code quality issues.
Small EVM Block
High-frequency HyperEVM execution block (~1s cadence) for regular transactions and lightweight contract calls.
SMT Solver
Satisfiability Modulo Theories solver - a mathematical engine that determines if logical constraints over various theories are satisfiable.
Solidity
The primary programming language for writing smart contracts on Ethereum and EVM-compatible blockchains.
Sovereign Recourse
The principle that legal ownership supersedes blockchain possession, requiring token standards to support administrative overrides that reflect off-chain legal reality.
Special Purpose Vehicle (SPV)
A bankruptcy-remote legal entity created solely to hold a specific asset, providing legal isolation between the asset and its issuer.
Specification Gap
The disconnect between what formal verification can prove about code logic and the economic soundness of that logic under real-world conditions.
Spot Price
Instantaneous exchange rate in an AMM pool calculated from the ratio of reserves at a given moment.
sqrtPriceX96
Fixed-point number format used in Uniswap v3 representing the square root of price multiplied by 2^96.
Stableswap
Curve's hybrid bonding curve formula optimizing for low slippage between assets expected to trade near 1:1 parity.
Staleness
The condition where oracle data or moving average values are outdated and no longer reflect current market conditions.
State Explosion Problem
The exponential growth of possible execution paths in smart contracts that makes exhaustive symbolic verification computationally infeasible.
State Machine
A design pattern where a smart contract has defined stages or phases, with different functions available or different behavior in each state.
Stateless Fuzzing
A fuzz testing approach where each test run is independent, with no state carried between iterations.
Static Analysis
Automated examination of smart contract code without executing it to identify potential vulnerabilities, bugs, and code quality issues.
Storage Collision
Critical vulnerability in proxy contracts where proxy and implementation use the same storage slot for different variables, causing state corruption.
Storage Slot
32-byte memory location in EVM persistent storage where contract state variables are stored, with access costs significantly higher than memory.
STRIDE
Microsoft-developed threat classification framework covering Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
Subresource Integrity (SRI)
Security feature that lets browsers verify externally loaded scripts and stylesheets haven't been tampered with using cryptographic hashes.
Supply Chain Attack
A security breach that targets dependencies, libraries, or third-party services rather than attacking the protocol directly.
SVM (Solana Virtual Machine)
The runtime environment that executes programs on Solana using a parallelized, stateless account model, compiled to Solana Bytecode Format (SBF).
Swiss Cheese Model
Risk analysis model illustrating how failures must align across multiple independent defense layers for a catastrophic breach to occur.
Symbolic Execution
A program analysis technique that uses symbolic values instead of concrete inputs to explore all possible execution paths simultaneously.
T
Technical Due Diligence
Investor evaluation process examining smart contract code quality, security posture, and engineering practices before funding.
Test Coverage
A metric measuring what percentage of code is executed during testing, indicating how thoroughly a codebase has been tested.
Threat Modeling
Structured process of identifying, evaluating, and prioritizing potential security threats to a system during the design phase before code is written.
Ticks
Discrete price points in Uniswap v3 that define boundaries for concentrated liquidity positions.
Timelock
Smart contract mechanism enforcing mandatory delay between initiating and executing critical protocol changes for transparency.
Token Partition
Named tranche (bytes32 key) within ERC-1410 tokens separating shares by legal status such as locked, vested, or freely tradable.
Token-2022
Solana token standard (Token Extensions) that adds programmable features like Transfer Hooks, Confidential Transfers, and CPI guards, reintroducing control-flow and reentrancy considerations.
Tokenization (AI)
The process of breaking text into smaller units (tokens) that AI models can process, determining how the model perceives and handles input.
Tool Integration Security
Security practices for validating and controlling how AI systems interact with external tools, APIs, and services to prevent unauthorized actions.
Training Poisoning
Attack inserting malicious data into AI training sets to corrupt model behavior and predictions.
Transaction
A signed message that changes blockchain state, including token transfers, contract interactions, and deployments.
Transaction Simulation
Process of predicting the exact on-chain outcome of a blockchain transaction before signing, revealing hidden state changes or malicious behavior.
Transfer Hook
Token-2022 extension that runs custom program logic on every transfer of a mint, enabling compliance and composability but introducing reentrancy-like and context-validation risks.
Transient Accounting
EIP-1153 storage pattern tracking net balance changes within transactions, settling only final amounts to reduce gas costs.
Trust Boundary
Interface where data enters protocol or assets move between components, representing highest-risk areas requiring focused security analysis.
TVL
Total Value Locked representing the aggregate dollar value of assets deposited in a DeFi protocol at any given time.
TWAP (Time-Weighted Average Price)
A price calculation method that averages asset prices over a time period to resist short-term manipulation.
TWAP Oracle
Time-Weighted Average Price oracle that accumulates prices over time to provide manipulation-resistant price feeds.
tx.origin
A Solidity global variable that returns the address of the externally owned account (EOA) that originally initiated the transaction.
U
UI Injection
An attack where malicious code is inserted into a user interface to manipulate displayed transaction data while altering execution.
Unchecked Arithmetic
Solidity optimization disabling automatic overflow/underflow checks when mathematical impossibility can be proven, reducing gas costs.
Unit Test
A test that verifies the behavior of a single function or component in isolation from the rest of the system.
V
Validator Set
The group of nodes responsible for validating transactions and reaching consensus in a blockchain network or cross-chain bridge.
Vault Accounting
Internal tracking system for token balances within a protocol's central contract, separate from actual token transfers.
Vote-Escrowed Token
Governance token locked for extended periods to gain voting power and rewards, pioneered by Curve's veCRV.
Vyper
Pythonic smart contract programming language designed for EVM emphasizing auditability and security through restrictive coding patterns.
W
Weighted Pool
Balancer's multi-asset pools with customizable weight ratios enabling decentralized index fund functionality.
WETH
Wrapped ETH - an ERC20-compliant token representing ETH, necessary for standard token operations in protocols.
Withdrawal Pattern
A security pattern where users pull funds from a contract rather than the contract pushing funds to users, reducing reentrancy risk.
Z
Can't find what you're looking for?
We're constantly expanding our glossary. If you need clarification on a specific term, feel free to reach out.
Ask Our Auditors
