Threat feed
A curated feed: short dated alerts and write-ups on live drain vectors. Each entry carries a date and a severity, and links to our analysis or to an authoritative source. Not auto-aggregated — added by hand, accuracy over speed.
-
HighNovember 13, 2026
Permit drainers: tokens leave without a single transaction
Phishing asks you to "sign in" — you sign a permit with an unlimited allowance, and the attacker spends your tokens later. We break down the EIP-2612/Permit2 mechanics and the defense.
Read the analysis → -
Write-upNovember 13, 2026
We open-sourced an ERC-4626 invariant harness
A catalog of invariants + a Foundry fuzzing harness: catches donation/inflation on vaults with zero false positives. For anyone building vaults.
Read →