Latest case · Incident response
Two of three signing keys for Obsidian Rollup’s upgrade multisig lived on the same host. How an upgrade of the withdrawal portal was scheduled with them, detected within seconds and cancelled inside the delay.
Filter by vulnerability class, ecosystem or origin. Every case uses the same ten sections, so they can be read side by side.
8 case studies
Obsidian Rollup
Ethereum
Two of three signing keys for Obsidian Rollup’s upgrade multisig lived on the same host. How an upgrade of the withdrawal portal was scheduled with them, detected within seconds and cancelled inside the delay.
Larkspur Wallet SDK
Cosmos
A look-alike dApp asked Cosmos users to sign authz grants. How the campaign was detected and contained in hours, and how a later assessment found the general cause: approval screens built from what the requester said, not what was signed.
Quillon Vaults
Ethereum
How a one-unit deposit and a direct transfer could capture every later deposit into a new Quillon vault, and why a virtual share offset makes the attack lose money instead.
Axeline Bridge
Optimism
Two attested transfers accepted on a chain they were never sent to. How monitoring caught the replay on Axeline Bridge, why the attestation did not bind the destination, and how typed digests fixed it.
Thessaly Governance
Optimism
Borrowed voting power, a one-block voting delay, and a timelock that let a proposal lower the delay it was subject to. How Proposal 41 on Thessaly Governance was detected at creation and cancelled.
Corvid AMM
Solana
On Solana the caller chooses every account. Two missing constraints in a Corvid AMM release would have let anyone drain a pool with a token mint they created, and collect protocol fees without a signature.
Tamarind Staking
Aptos
Why a late stake into an old Tamarind position collected rewards it never earned, and how the same analysis showed that index rounding was small enough to accept.
Veyra Finance
Base
Every path a price takes into Veyra Finance: a staleness rule that did not match the feed, a spot-price fallback that the protocol’s own flash loans could move, and the minutes after a sequencer restart.
Structure
01
Background
The protocol, the release or incident, and why it mattered.
02
Architecture
A diagram generated from the protocol’s components, with the parts involved highlighted.
03
Security challenge
The question the investigation had to answer.
04
Attack surface
Every input examined, its exposure and the control that now covers it.
05
Technical investigation
Transaction sequence, computed tables and, for incidents, the monitoring record.
06
Root cause
The defect itself, shown in the code that contained it.
07
Risk evaluation
Quantix Risk Index during the case and today, component by component.
08
Mitigation strategy
The steps taken and the fix as it was merged.
09
Security outcome
What changed, with time to containment and to a verified fix.
10
Lessons learned
What applies beyond this protocol.
Share the system and the question you need answered. We will reply with the review plan we would use, written for your architecture.
