Blog
Security research, in plain English.
Notes on smart contract audits, onchain risk, and building security into every phase of development.
3 min read
An Audit Is a Snapshot: Why Smart Contract Security Needs to Shift Left
A PDF at the end of development is a snapshot of one commit on one day. Here's what security looks like across the whole lifecycle.
Shift LeftSDLCAudit Process
3 min read
The OWASP Smart Contract Top 10 (2026), and How We Test Each One
A plain-English walkthrough of all ten categories in the 2026 list, and how fork testing turns each suspicion into a proven exploit.
OWASPAudit ProcessSmart Contracts
3 min read
Why CVSS Doesn't Fit Smart Contract Bugs, and What We Use Instead
CVSS can't say user funds can be stolen or that an attacker can borrow capital for free. OVSS, our open onchain scoring system, can.
OVSSSeveritySmart Contracts
4 min read
What the Binance Breach Teaches Protocol Teams About Security Beyond the Code
The largest crypto theft on record reportedly began with a compromised laptop, not a contract bug. What it means for keepers and deploy pipelines.
Incident AnalysisOperational Security