A structured 7-stage audit using an orchestrator + subagent architecture for security auditing of blockchain node implementations. Covers execution clients, consensus clients, app-chain SDKs, bridges, and any codebase with P2P networking or consensus logic. ## Pipeline 1. **Setup**— creates output directories, records audit parameters 2. **Recon**— maps codebase structure, entry […]

A DFS-based AI security auditor for Solidity. The lead auditor reads code, builds a structured context map, extracts value-flow call paths, then delegates each path to a hunt agent for line-by-line depth-first analysis. Findings are merged, deduplicated, and validated. ## Pipeline 1. **Reconnaissance**— discover `.sol` files, resolve skill references, create […]

# SubQuery Network: Missing Access Control in `Settings` Enables Staking Drain On April 12, 2026, SubQuery Network, a staking protocol on Base, (block 44,590,469) suffered an access-control exploit that drained approximately **218.29M SQT** (about **$131.2K**) from the protocol’s Staking contract. The attacker deployed two ephemeral contracts, abused the absence of […]

# Given Enough Agents, All Bugs Become Shallow A few months ago I had this realization that agents have become really good at identifying bugs in code, especially security vulnerabilities. They are relentless in analyzing code and you can spin up multiple of them to go through source code quickly. […]

CVE-2026-24450 An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. The versions below were either tested or verified to be vulnerable by Talos […]

CVE-2026-20911 A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. The versions below were either tested or verified to […]

CVE-2026-24660 A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. The versions below were either tested or verified to be vulnerable by […]

Enable JavaScript and cookies to continue

# Denaria Finance: Virtual AMM Manipulation via Unprotected `realizePnL` On April 5, 2026, Denaria Finance, a perpetual DEX on Linea, (block 30,067,821) suffered a virtual AMM manipulation attack that drained approximately **165,618 USDC** from the protocol’s Vault. The attacker flash-loaned 60,000 USDC from Aave V3, deployed pairs of ephemeral LP […]

A recent article of the OpenBSD journal caught me attention: Pledge changes in 7.9-beta (archive.org mirror as it’s currently offline). The quoted message starts with: > Previously under certain promises it was possible to open certain files or devices even if the program didn’t pledge “rpath” or “wpath”. This behavior […]