Remedy Blog
Web3 security blog by the Remedy community.
Featured
GetBlock Completes SOC 2 Type II Attestation
GetBlock completed a SOC 2 Type II attestation, audited by Atom Assurance, letting the Web3 RPC node provider onboard banks and regulated enterprise clients.
Read moreArticles
Lido V2 Audit: Critical Flaw Caught Before Launch
Inside Hexens' Lido V2 audit: 25 findings, 1 critical way to steal ETH by bypassing the withdrawal discount factor, and why manual review caught what scanners can't.
MainStreet Project "Autopsy" Report: msUSD and msY Token Depeg Incident
How MainStreet's msUSD and msY tokens depegged 96%: the mint/arbitrage mechanism, off-protocol USDC redeployment, and $23M in Morpho bad debt.
Inside a Native Rust Solana Audit: Security Pitfalls Every Builder Should Know
Five real vulnerabilities from a Native Rust Solana audit: account type confusion, CPI validation gaps, and unsafe closes, with fixes every builder needs.
The Smoke Detector Problem: What On-Chain Monitoring Can and Can't Stop in 2026
Detecting an attack is largely solved. Stopping it depends entirely on the attack's shape — and on whether a response was wired before the alarm fired.
Understanding ABI Encoding for Dynamic Bytes in Solidity
A byte-by-byte walkthrough of ABI encoding for dynamic bytes in Solidity: what the offset, length, and data chunks actually mean in raw calldata.
I Was Out-Hunted by My Own AI: Where Human Researchers Still Win and How to Make It Count
A bug hunter on where AI now beats humans in smart contract security, breadth, depth, and bug combinations and where human judgment still wins. Featuring Grego AI.
Rust Compiler For Dummies
A beginner-friendly walkthrough of the Rust compiler: how source code becomes binary through lexing, AST, HIR/THIR, MIR borrow checking, and LLVM code generation.
Ethereum vs Solana: How Execution Models Shape Smart Contract Bugs
Ethereum vs Solana from a security researcher's lens: how the EVM's shared-ledger model and Solana's account-based runtime shape completely different smart contract bugs.
Polygon zkEVM Security Review: Four Critical Findings Fixed
Hexens' Polygon zkEVM security review found 16 issues, 4 critical, from missing PIL constraints to an ERC-777 bridge re-entrancy.
Taiko Bridge Exploit Headlines a $340M Year for Bridge Hacks
Taiko bridge exploit: an attacker used a Raiko SGX signing key exposed on GitHub to forge withdrawal proofs, adding to a $340M year of bridge hacks.
How to Detect Oracle Risk in Morpho Markets Using Glider
Hexens uses Glider's static analysis to flag four oracle misconfigurations in Morpho markets: hardcoded prices, stale feeds, and missing circuit breakers.
How to Learn Fuzzing for Smart Contract Security | From Recon
Learn fuzzing for smart contract security from Recon. A curated video path from your first test to breaking real Solidity protocols with Echidna and Foundry.