Blockchain security audits and research.https://osec.io/https://osec.io/blog/rctf-v2/https://osec.io/blog/rctf-v2/We’re releasing rCTF v2, an open-source platform for hosting cybersecurity capture-the-flag competitions.Tue, 14 Jul 2026 00:00:00 GMThttps://osec.io/blog/save-ctfs-fund/https://osec.io/blog/save-ctfs-fund/OtterSec is committing $100,000 to keep CTFs competitive in the age of AI. We break down why Jeopardy scoring is breaking down, what better formats might look like, and how to apply for sponsorship.Tue, 07 Jul 2026 12:00:00 GMThttps://osec.io/blog/hyperliquid-risk-engine/https://osec.io/blog/hyperliquid-risk-engine/Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid’s risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.Mon, 22 Jun 2026 12:00:00 GMThttps://osec.io/blog/goldmine-of-insecure-webview-integrations/https://osec.io/blog/goldmine-of-insecure-webview-integrations/WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.Thu, 18 Jun 2026 12:00:00 GMThttps://osec.io/blog/minecraft-heap-overflow-to-rce/https://osec.io/blog/minecraft-heap-overflow-to-rce/We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.Tue, 02 Jun 2026 12:00:00 GMThttps://osec.io/blog/unverified-evaluations-dusk-plonk/https://osec.io/blog/unverified-evaluations-dusk-plonk/Dusk’s privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk’s verifier never validated four of the prover’s polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.Thu, 30 Apr 2026 12:00:00 GMThttps://osec.io/blog/patch-gap-to-mobile-renderer-rce/https://osec.io/blog/patch-gap-to-mobile-renderer-rce/Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.Wed, 01 Apr 2026 12:00:00 GMThttps://osec.io/blog/virtio-snd-qemu-hypervisor-escape/https://osec.io/blog/virtio-snd-qemu-hypervisor-escape/Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.Tue, 17 Mar 2026 12:00:00 GMThttps://osec.io/blog/zkvms-unfaithful-claims/https://osec.io/blog/zkvms-unfaithful-claims/A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.Tue, 03 Mar 2026 12:00:00 GMThttps://osec.io/blog/paymasters-evm/https://osec.io/blog/paymasters-evm/ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.Tue, 02 Dec 2025 12:00:00 GMThttps://osec.io/blog/how-we-broke-exchanges-oauth-misconfigurations/https://osec.io/blog/how-we-broke-exchanges-oauth-misconfigurations/OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.Thu, 16 Oct 2025 12:00:00 GMThttps://osec.io/blog/how-to-survive-supply-chain-attacks/https://osec.io/blog/how-to-survive-supply-chain-attacks/The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.Sat, 13 Sep 2025 12:00:00 GMThttps://osec.io/blog/how-proof-of-reserves-uses-zk-to-protect-your-funds/https://osec.io/blog/how-proof-of-reserves-uses-zk-to-protect-your-funds/Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof of reserves enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.Wed, 27 Aug 2025 00:00:00 GMThttps://osec.io/blog/compiler-bug-causes-compiler-bug/https://osec.io/blog/compiler-bug-causes-compiler-bug/A subtle G++ bug from 2012, C++20’s new comparison rules, and legacy Boost code can collide to crash Solidity’s compiler on valid code. We unpack the surprising chain reaction and how to fix it.Mon, 11 Aug 2025 00:00:00 GMThttps://osec.io/blog/cosmos-security/https://osec.io/blog/cosmos-security/From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.Tue, 10 Jun 2025 00:00:00 GMThttps://osec.io/blog/king-of-the-sol/https://osec.io/blog/king-of-the-sol/Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.Wed, 14 May 2025 00:00:00 GMThttps://osec.io/blog/subverting-web2-authentication-in-web3/https://osec.io/blog/subverting-web2-authentication-in-web3/Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.Fri, 07 Mar 2025 00:00:00 GMThttps://osec.io/blog/multisig-security/https://osec.io/blog/multisig-security/What can teams do if their multisig signers are compromised? We explore Solana’s transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.Sat, 22 Feb 2025 00:00:00 GMThttps://osec.io/blog/hitchhikers-guide-to-aptos-fungible-assets/https://osec.io/blog/hitchhikers-guide-to-aptos-fungible-assets/We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.Mon, 10 Feb 2025 00:00:00 GMThttps://osec.io/blog/netfilter-universal-root-1-day/https://osec.io/blog/netfilter-universal-root-1-day/A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.Mon, 25 Nov 2024 00:00:00 GMThttps://osec.io/blog/supply-chain-attacks-a-new-era/https://osec.io/blog/supply-chain-attacks-a-new-era/Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.Mon, 10 Jun 2024 00:00:00 GMThttps://osec.io/blog/rounding-bugs/https://osec.io/blog/rounding-bugs/Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.Thu, 18 Jan 2024 00:00:00 GMThttps://osec.io/blog/jumping-around-in-the-vm/https://osec.io/blog/jumping-around-in-the-vm/An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.Mon, 11 Dec 2023 00:00:00 GMThttps://osec.io/blog/metamask-snaps/https://osec.io/blog/metamask-snaps/A deep dig into MetaMask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.Wed, 01 Nov 2023 00:00:00 GMThttps://osec.io/blog/web2-bug-repellant-instructions/https://osec.io/blog/web2-bug-repellant-instructions/An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.Fri, 11 Aug 2023 00:00:00 GMThttps://osec.io/blog/vyper-timeline/https://osec.io/blog/vyper-timeline/A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehat recoveries.Tue, 01 Aug 2023 00:00:00 GMThttps://osec.io/blog/solidity-compilers-memory-safety/https://osec.io/blog/solidity-compilers-memory-safety/An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.Fri, 28 Jul 2023 00:00:00 GMThttps://osec.io/blog/formally-verifying-solana-programs/https://osec.io/blog/formally-verifying-solana-programs/We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.Thu, 26 Jan 2023 00:00:00 GMThttps://osec.io/blog/rust-realloc-and-references/https://osec.io/blog/rust-realloc-and-references/Rust is safe… right? Not if your dependencies are unsafe… A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.Fri, 09 Dec 2022 00:00:00 GMThttps://osec.io/blog/move-prover/https://osec.io/blog/move-prover/A practical guide to the Move Prover — tutorial, case study, and specifications.Fri, 16 Sep 2022 00:00:00 GMThttps://osec.io/blog/move-introduction/https://osec.io/blog/move-introduction/What actually makes Move secure? A discussion of Move’s typing system and formal verification.Tue, 06 Sep 2022 00:00:00 GMThttps://osec.io/blog/reverse-engineering-solana/https://osec.io/blog/reverse-engineering-solana/An introduction to our open-source Binary Ninja plugin for blackbox Solana program analysis along with an executive reference to the Solana runtime.Sat, 27 Aug 2022 00:00:00 GMThttps://osec.io/blog/solend-rent-thief/https://osec.io/blog/solend-rent-thief/A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.Fri, 19 Aug 2022 00:00:00 GMThttps://osec.io/blog/spl-swap-rounding/https://osec.io/blog/spl-swap-rounding/How we discovered a critical issue in Solana’s stable swap implementation. A story about arbitrage and rounding.Tue, 26 Apr 2022 00:00:00 GMThttps://osec.io/blog/solana-security-intro/https://osec.io/blog/solana-security-intro/A security-focused introduction to Solana, exploring the underlying runtime environment, security boundaries, and implications. An important resource for all developers who want to write more secure code.Mon, 14 Mar 2022 00:00:00 GMThttps://osec.io/blog/lp-token-oracle-manipulation/https://osec.io/blog/lp-token-oracle-manipulation/How we fooled oracles to beat the house. An exploration into liquidity tokens and oracle price manipulation.Wed, 16 Feb 2022 00:00:00 GMT