DevOps

The fee-on-transfer bug that locks funds forever (with a working PoC)

Last week I found this pattern in a real audit. I can't name the protocol — it's under responsible-disclosure until the program confirms a fix — but…

I ran my Solidity scanner on 6 top-audited DeFi protocols. Every 'critical' was a false positive — here's why.

Most Solidity scanners are high-recall, low-precision. They flag 40 things, 38 are noise, and after the third report you stop reading them — so the…

Shipping a Solidity contract to mainnet? Do this 20-minute self-check first

You built something. Tests pass. You're days from mainnet. Before you either skip security entirely (please don't) or spend weeks lining up a full a…

I ran my Solidity scanner across the 10 most-audited codebases in web3. Here's every flag.

The dirty secret of automated smart-contract security tools isn't that they miss bugs. It's that they cry wolf. Point a typical static analyzer at a…

Beyond Static Code: Building an AI-Powered "VC Critic" on Somnia

For years, smart contracts have been described as "smart," but in reality, they have been static . They could move assets and follow rigid if/then r…