Stop 10 · Research
Long-form research across nine areas, from vault share-price manipulation to zero-knowledge circuit soundness, with diagrams, code, recommendations and bibliographies.
Press / to search from anywhere on the page, Esc to clear.
Showing 19 of 19 publications.
Technical analysisThreat Intelligence8 min read
Many exploits are preceded by preparation that is visible on-chain: funding, deployment, rehearsal. A structured look at the signals, how far each can be trusted, and how to turn them into detection rules.
By Quantix Research, Threat Intelligence
PrimerDeFi Security6 min read
An empty tokenised vault can be manipulated so that the next depositor receives no shares. Why the arithmetic allows it, and how virtual shares, dead shares and slippage checks close the gap.
By Quantix Research, DeFi Security
PrimerSmart Contract Vulnerabilities8 min read
A contract can be safe from classic reentrancy and still expose an inconsistent state to anyone who reads it mid-call. How the pattern works, and how integrators should defend against it.
By Quantix Research, Smart Contract Security
Technical analysisIncident Analysis6 min read
Bridges concentrate value behind a verification step that most users never see. A taxonomy of how that step has failed in public incidents, from key compromise to forged proofs, and what each failure implies for design.
By Quantix Research, Cross-Chain Security
PrimerSmart Contract Vulnerabilities7 min read
Upgradeable contracts move construction logic into ordinary functions. That small change creates a family of access-control failures that a constructor would never allow.
By Quantix Research, Smart Contract Security
Technical analysisFormal Verification6 min read
Provers can establish that a property holds in every reachable state. Whether that matters depends on which properties were written, what the model assumed, and what was left out. A practitioner’s map.
By Quantix Research, Formal Methods
PrimerBlockchain Infrastructure7 min read
Frontends and backends trust the node they query. A review of what an untrusted or misconfigured RPC layer can do to an otherwise sound application.
By Quantix Research, Infrastructure Security
PrimerCross-Chain Security6 min read
A signature proves that someone agreed to something. Unless the message says where and how often, it can be presented again on another chain, another contract or another day. The binding fields, and how they fail.
By Quantix Research, Cross-Chain Security
PrimerWallet Security7 min read
Permit-style signatures let users authorise transfers without sending a transaction. The same property makes them a favoured tool for phishing. What wallets, dApps and users can check.
By Quantix Research, Wallet Security
Technical analysisBlockchain Infrastructure6 min read
Transaction ordering is a resource that someone will sell. How maximal extractable value reaches users through the block-building pipeline, and which protocol designs reduce what can be extracted.
By Quantix Research, Infrastructure Security
PrimerDeFi Security7 min read
Every price source has a cost of manipulation. Protocols are safe only while that cost exceeds what an attacker can extract. A framework for estimating both sides.
By Quantix Research, DeFi Security
PrimerSmart Contract Vulnerabilities7 min read
A proxy splits a contract into the address users trust and the code that runs behind it. Every upgrade is a chance to break the agreement between the two. The failure modes, by layer.
By Quantix Research, Smart Contract Security
PrimerFormal Verification7 min read
Fuzzers and provers are only as good as the properties they check. How to move from vague requirements to invariants precise enough to fail.
By Quantix Research, Formal Methods
PrimerSmart Contract Vulnerabilities6 min read
Solana programs receive their state as a list of accounts chosen by the caller. Most serious bugs come from trusting that list. The checks every instruction needs, and how Anchor helps and where it does not.
By Quantix Research, Smart Contract Security
Technical analysisDeFi Security6 min read
On-chain governance turns token balances into authority over code and treasuries. How that authority has been borrowed, bought, hidden in proposal payloads and routed around timelocks.
By Quantix Research, DeFi Security
Technical analysisDeFi Security7 min read
Spot prices, time-weighted averages, push feeds and pull feeds fail in different ways. A comparison of oracle designs, the assumptions each makes, and the checks a consuming contract must add.
By Quantix Research, DeFi Security
PrimerSmart Contract Vulnerabilities6 min read
Move’s type system rules out whole classes of EVM bugs: resources cannot be copied or silently dropped. Capability leaks, generic confusion, arithmetic aborts and upgrade semantics remain. A review guide for Aptos and Sui.
By Quantix Research, Smart Contract Security
PrimerFormal Verification6 min read
Coverage-guided and stateful fuzzers explore sequences of calls no reviewer would think to write. How they work, how to give them good inputs, and how to tell whether a green run means anything.
By Quantix Research, Formal Methods
PrimerZero-Knowledge Systems6 min read
A proof is only as strong as the constraints behind it. When a circuit computes a value without constraining it, a prover can choose a different one. How under-constrained circuits arise in Circom and how to find them.
By Quantix Research, Zero-Knowledge Systems
