Smart Contract Audits

A protocol built on XML signatures

Trail of Bits argues SAML should be deprecated: it is comprehensible on its own terms and rests on a signature-validation layer that has defeated most implementations.

2026-09-21·3 min·Source: Trail of Bits

Sixty findings, none critical, in Miden

An OpenZeppelin review of the Miden contract library reports no critical or high issues and eleven medium ones, most of them about authorisation.

2026-08-26·3 min·Source: OpenZeppelin

A zero that matched another zero

One stale field let any account claim admin over 82 markers on Provenance. The check compared a supply that was never written back.

SeverityHigh

2026-08-25·3 min·Source: Trail of Bits

Two files, eleven findings, five assumptions

OpenZeppelin's review of the TxFlow bridge found no critical or high issues. The list of things the bridge takes on trust is longer than the list of bugs.

SeverityMedium

2026-08-21·3 min·Source: OpenZeppelin

A freeze that burning could walk around

Thirty-two findings on a single gold-backed token contract, and the high-severity one was a compliance control with three ways past it.

2026-08-19·3 min·Source: OpenZeppelin

A control at the interface is not a control

OpenZeppelin sets out how institutions gate participation on public chains, and where the enforcement has to live to count.

2026-08-18·2 min·Source: OpenZeppelin

Nineteen findings, none critical, six still open

OpenZeppelin's review of the Across V5 bridging extensions is more useful for what stayed unresolved than for what was fixed.

2026-08-17·2 min·Source: OpenZeppelin

Audits find what the scope allows them to find

Most losses this year came from code that was audited. The finding was outside the brief.

SeverityHigh

2026-08-10·10 min

Formal verification quietly left the lab

Specification effort still dominates, but the tooling is no longer the bottleneck.

SeverityLow

2026-08-06·7 min

Reentrancy is back, through token callbacks

The classic pattern was closed. Hook-bearing token standards reopened it sideways.

SeverityCritical

2026-08-02·6 min

Bug bounties still price below the exploit

When the payout is a fraction of what the bug is worth, disclosure is a donation.

SeverityModerate

2026-07-29·5 min