Original research into the bugs we break.
Exploring new attack surfaces, crafting full exploit chains, and breaking what's supposed to be unbreakable.
Mysticeti-FPC promises fast transaction finality by relaxing ordering requirements for owned objects. But when garbage collection prunes votes too early, validators can disagree on which transactions to accept—breaking safety and enabling double spends. We dissect the bug, a patch that backfired, and the fix that finally worked.
Mysticeti-C, Sui's DAG-based consensus algorithm, claims strong liveness guarantees. However, a subtle flaw allows attackers to repeatedly stall leader-slot decisions, halting the entire chain. In this post, we dive into how this vulnerability works, why it slipped past the original liveness proof, and what it means for DAG-based consensus going forward.
What "really" is a blockchain? How does consensus actually work? Why is it safe? In this blog, we're going to introduce the real fundamentals of a blockchain that suprisingly no one talks about. In the end, you'll walk away with a clear, intuitive understanding of how blockchains actually hold together — and you'll see the technology in a way most people never do.
A deep dive into a critical vulnerability in Solana's Direct Mapping optimization that could have allowed remote code execution on validator nodes and compromised over $9 billion in total value locked. This technical analysis walks through the complete bug hunting process—from initial discovery to working exploit—demonstrating how even memory-safe languages like Rust can harbor powerful vulnerabilities in complex systems. While the vulnerable feature was never enabled on mainnet, this research reveals the intricate security challenges in blockchain performance optimizations and provides rare insight into real-world vulnerability research methodology.
In this blog, we will walk through the findings we reported during the Ethereum Attackathon. The attackathon had a 1.5M reward pool, but only 0.5M is unlocked. These bugs totaled nearly 150K in rewards, which allegedly earned us 1st place in the Attackathon.
During the Fuel Attackathon, our team reported several Sway compiler bugs that went unfixed. After Fuel's mainnet launch, one of these bugs caused Swaylend transactions to fail, leading to a 2-day service shutdown while the compiler was patched and contracts were redeployed.