Smart contract vulnerabilities

Smart Contract Vulnerabilities31 October 202611 min read

Smart contract audit checklist: readiness and security checks

What to prepare before a smart contract audit, the checks to run for each class in the OWASP Smart Contract Top 10: 2026, what Slither, fuzzers and provers catch and miss, and what to do after the report.

Smart Contract Vulnerabilities31 October 202611 min read

How to read a smart contract audit report, section by section

What each section of an audit report establishes and what it leaves open, how to check that deployed bytecode matches the audited commit, and the questions to ask before relying on a report.

Smart Contract Vulnerabilities31 October 202611 min read

Smart contract access control: owners, roles and privilege escalation

Access control leads OWASP’s Smart Contract Top 10. How ownership transfers, role-admin graphs, timelocks and multisigs fail, six common bugs with their fixes, and how to test who can call what.

Smart Contract Vulnerabilities6 October 20268 min read

Read-only reentrancy: when a view function tells the truth too early

A contract can be safe from classic reentrancy and still expose an inconsistent state to anyone who reads it mid-call. How the pattern works, and how integrators should defend against it.

Smart Contract Vulnerabilities22 September 20267 min read

Initializers, proxies and the contract nobody owns

Upgradeable contracts move construction logic into ordinary functions. That small change creates a family of access-control failures that a constructor would never allow.

Smart Contract Vulnerabilities4 August 20267 min read

Upgradeable proxy security: storage, selectors and the upgrade path

A proxy splits a contract into the address users trust and the code that runs behind it. Every upgrade is a chance to break the agreement between the two. The failure modes, by layer.

Smart Contract Vulnerabilities21 July 20266 min read

Solana program security: every account is an input

Solana programs receive their state as a list of accounts chosen by the caller. Most serious bugs come from trusting that list. The checks every instruction needs, and how Anchor helps and where it does not.

Smart Contract Vulnerabilities30 June 20266 min read

The Move security model, and where it stops

Move’s type system rules out whole classes of EVM bugs: resources cannot be copied or silently dropped. Capability leaks, generic confusion, arithmetic aborts and upgrade semantics remain. A review guide for Aptos and Sui.