DeFi & Smart Contract
Security Research Lab
Manual code audits, formal verification, ZKP circuit review, and active fuzzing — from a Berlin-based researcher with a published CVE track record and hands-on DeFi exploit experience.
Recent Security Incidents
Rhea Finance Security Incident
Rhea Finance - RektTuesday, April 21, 2026Rhea Finance - Swap Route Exploitation - Input Validation Failure 42 hours of preparation. 123 fake tokens. 5 worker wallets dispatched within 10 seconds of each other. $18.4 million gone from the largest protocol in NEAR's DeFi ecosystem before most of its users had finished their morning coffee.
Hyperbridge Security Incident
Hyperbridge - RektFriday, April 17, 2026Hyperbridge - MMR - Proof Verification 1 billion DOT tokens minted, $2.5 million in losses, one missing line of code. Initially reported as a $237k loss, Hyperbridge revised that figure to $2.5 million, citing two separate attacks and users who swapped into artificially cheap DOT after the pools were drained.
Drift Protocol Security Incident
Drift Protocol - RektThursday, April 9, 2026Private Key Leak - Drift Protocol - DPRK Credit: DLNews, Drift Protocol, DefiLlama, Mert, Vladimir S., Peckshield, Arkham Intelligence, Lookonchain, Unchained, CCN, CoinTelegraph, Andrew Hong, QuillAudits, wublock, ZachXBT, Specter, Temmy, TheBlock, molu, Fabiano, Omer Goldberg, Hayden Adams, Cube Exchange, BleepingComputer, Halborn, Tayvano, Ariel Givner, CoinDesk, The Hacker News, Mitchell Amador, TRM, Blockworks, Chainalysis, Patrick Collins
‘Scattered Spider’ Member ‘Tylerb’ Pleads Guilty
A 24-year-old British national and senior member of the cybercrime group "Scattered Spider" has pleaded guilty to wire fraud conspiracy and aggravated identity theft. Tyler Robert Buchanan admitted his role in a series of text-message phishing attacks in the summer of 2022 that allowed the group to hack into at least a dozen major technology companies and steal tens of millions of dollars worth of cryptocurrency from investors.
Patch Tuesday, April 2026 Edition
Microsoft today pushed software updates to fix a staggering 167 security vulnerabilities in its Windows operating systems and related software, including a SharePoint Server zero-day and a publicly disclosed weakness in Windows Defender dubbed "BlueHammer." Separately, Google Chrome fixed its fourth zero-day of 2026, and an emergency update for Adobe Reader nixes an actively exploited flaw that can lead to remote code execution.
Resolv Labs Security Incident
Resolv Labs - RektTuesday, April 7, 2026Resolv Labs - Private Key Leak - Supply Chain Attack Three hundred thousand dollars walked into a protocol holding $141 million. Eighty million unbacked stablecoins walked out. The official post-mortem would later reveal a supply chain attack; the breach began not inside Resolv, but at a third-party project where a contractor had previously worked.
Russia Hacked Routers to Steal Microsoft Office Tokens
Hackers linked to Russia's military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code.
Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab
An elusive hacker who went by the handle "UNKN" and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion against victims across the country between 2019 and 2021.
‘CanisterWorm’ Springs Wiper Attack Targeting Iran
A financially motivated data theft and extortion group is attempting to inject itself into the Iran war, unleashing a worm that spreads through poorly secured cloud services and wipes data on infected systems that use Iran's time zone or have Farsi set as the default language.
Feds Disrupt IoT Botnets Behind Huge DDoS Attacks
The U.S. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million hacked Internet of Things (IoT) devices, such as routers and web cameras. The feds say the four botnets -- named Aisuru, Kimwolf, JackSkid and Mossad -- are responsible for a series of recent record-smashing distributed denial-of-service (DDoS) attacks capable of knocking nearly any target offline.
Security Research
CVE Pending: SIGSEGV in oggenc 1.4.3 (vorbis-tools) via Crafted WAV File
A crafted WAV file triggers a null pointer dereference / segmentation fault (SIGSEGV) in oggenc 1.4.3, crashing the encoder unconditionally. Reproducible with a single Python command. No user interaction beyond passing the file to oggenc is required. CVE requested — assignment pending.
CVE Unhandled IEEE754 Special Values in Wings3D 2.4.1 OBJ Parser
A crafted Wavefront OBJ file containing IEEE754 special float values (nan, inf, -inf) or overflow exponents (1e999) in vertex coordinate fields causes Wings3D to crash immediately on import. Root cause: the Erlang function str2float_2/2 in e3d_obj.erl (line 391) uses pattern matching with no clause for IEEE754 special value strings, raising an unhandled function_clause exception that unwinds the BEAM VM call stack and terminates the import. All unsaved user work is lost. Vendor notified: sourceforge.net/p/wings/bugs/252/
CVE : Uncontrolled Resource Consumption in Scribus 1.6.5
A crafted .sla project file with extreme numeric geometry values (PAGEWIDTH, HEIGHT, BORDERLEFT, etc.) causes Scribus to enter an infinite loop during layout containment checking, consuming 99% CPU and triggering a system-wide memory pressure cascade. No user interaction beyond opening the file is required. Root cause: geometry fields are read directly into Qt structures (QRect, QRegion) without upper or lower bounds enforcement.
CVE: Unsigned Firmware Update in Actions Semiconductor Platform
The firmware update tool (RdiskUpgrade.exe / Production.dll) for all devices using Actions Semiconductor VID 10D6 performs zero cryptographic verification before flashing firmware over USB. An attacker with physical access can permanently compromise any affected device. Covers 12 USB Product IDs across multiple consumer brands. CVE submitted to MITRE — pending assignment.
CVE-2025-65834: Buffer Overflow in Shotcut 25.10.31
Buffer overflow in Shotcut video editor's MLT Framework image processing pipeline. An attacker can trigger out-of-bounds memory access via a crafted media file. CVE assigned by MITRE.
Recent Audits
Butter Network — Smart Contract Ecosystem Audit
Our Services
Smart Contract Audits
Manual line-by-line review of Solidity, Rust, Move, Cairo, and Motoko contracts. Covers reentrancy, access control, oracle manipulation, flash loan vectors, donation attacks, and economic logic flaws.
DeFi Protocol Security
Deep-dive audits for AMMs, lending protocols, bridges, and yield strategies. Specialized detection of TWAP manipulation, exchange rate inflation, cross-chain replay, and liquidation logic errors.
Cryptography & ZKP Audits
SDK-level cryptographic implementation review covering signature schemes, key derivation, RNG, and threshold cryptography. ZKP circuit audits for constraint soundness and under-constrained signal detection.
Formal Verification
Mathematical proof of critical protocol invariants — AMM pricing formulas, interest rate models, liquidation conditions. Custom specs in Certora, TLA+, or Coq depending on your stack.
Fuzzing Campaigns
Active fuzzing with custom harnesses using AFL++, Echidna, and Foundry invariant tests. Full coverage report and reproducible corpus delivered. Particularly effective for parser bugs and boundary conditions.
Backend & API Security
Security review of backend systems and APIs powering Web3 protocols — authentication, authorization, injection vulnerabilities, and business logic flaws in the off-chain layer.
Security Subscription Plans
Prefer a one-time engagement? We scope every audit individually — no fixed packages, no cookie-cutter reports.
Request a Custom QuoteISO 27001 Readiness Assessments
Gap Analysis
Comprehensive evaluation of current security posture against ISO 27001 requirements with detailed remediation roadmap.
Control Assessment
Systematic review of all 114 security controls with evidence collection and documentation support.
Implementation Support
Practical guidance on implementing missing controls and building compliant security management systems.
Supported Compliance Frameworks
Request a Security Audit
Tell us about your project. We scope every engagement individually — no fixed packages, no cookie-cutter reports.
We typically respond within 24 hours with a custom quote based on your project scope and requirements.
Frequently Asked Questions
Contact Us
General inquiries, partnerships, or media requests.