OtterSec Blog

Blog
Careers
1
Team
Services
Testimonials
Audits
Get in touch

Hitchhiker's Guide to Aptos Fungible Assets

We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws o...

Security exploits, tutorials, and findings

Feb 10, 2025

Hitchhiker's Guide to Aptos Fungible Assets

Nov 25, 2024

OtterRoot: Netfilter Universal Root 1-day

A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.

Jun 10, 2024

Supply Chain Attacks: A New Era

Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.

Jan 18, 2024

Rounding Bugs: An Analysis

Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.

Dec 11, 2023

Solana: Jumping Around in the VM

An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.

Nov 1, 2023

Metamask Snaps: Playing in the Sand

A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.

Aug 11, 2023

Web2 Bug Repellant Instructions

An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.

Aug 1, 2023

Vyper Hack Timeline

A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.

Jul 28, 2023

Solidity Compilers: Memory Safety

An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.

Jan 26, 2023

Solana Formal Verification: A Case Study

We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.

Dec 9, 2022

Rust, Realloc, and References

Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.

Sep 16, 2022

The Move Prover: A Guide

A practical guide to the Move Prover - tutorial, case study, and specifications.

Sep 6, 2022

Move: An Auditor's Introduction

What actually makes Move secure? A discussion of Move's typing system and formal verification.

Aug 27, 2022

Reverse Engineering Solana with Binary Ninja

An introduction to our open-source Binary Ninja plugin for blackbox Solana program analysis along with an executive reference to the Solana runtime.

Aug 19, 2022

The Story of the Curious Rent Thief

A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.

Apr 26, 2022

Becoming a Millionaire, 0.000150 BTC at a Time

How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.

Mar 14, 2022

Solana: An Auditor's Introduction

A security focused introduction to Solana, exploring the underlying runtime environment, security boundaries, and implications. An important resource for all developers who want to write more secure code.

Feb 16, 2022

The $200m Bluff: Cheating Oracles on Solana

How we fooled oracles to beat the house. An exploration into liquidity tokens and oracle price manipulation.

Security audits for smart contracts that protect blockchain ideas.

Get an audit

Social

Twitter
GitHub
Email