SecLat Blog
Insights on security and trust in Web3
Explore articles about audits, mitigation strategies, and lessons from our smart contract security team.
Recent posts
Notional Finance V1: how a uint128 conversion could have hidden 2^128 of debt
A technical analysis of the reported Notional Finance V1 incident, in which an unsafe conversion could have valued an extreme debt at zero and enabled the withdrawal of roughly $1.73 million.
Ethernaut Level 5 Walkthrough: Exploiting an Integer Underflow in Solidity
In this article, we will analyze and solve Ethernaut Level 5: Token.
Ethernaut Level 4 Walkthrough: Breaking tx.origin Authentication in Solidity
In this article, we will analyze and solve Ethernaut Level 4: Telephone.
The Avici Hack Shows Where Self-Custody Ends: The Hidden Risk in Crypto Card Contracts
The Avici incident shows why self-custody of a wallet does not remove risk once funds move into shared card-balance contracts.
Ethernaut Level 3 Walkthrough: Exploiting Weak On-Chain Randomness in Solidity
In this article, we will analyze and solve Ethernaut Level 3: Coin Flip.
An Oracle Does Not Need to Be Broken to Liquidate You: How Thin Liquidity, a Short TWAP, and Leverage Triggered Morpho Liquidations
How a thin DeFi market feeding a short TWAP can turn PT, YT, looped leverage, and health factors into a liquidation risk, and how teams can reduce it.
How Six Failures Turned a MAYAChain Outbound Bug Into a Pool Drain
A technical breakdown of how transaction-voter state, outbound matching, subsidy accounting, and pool math compounded into a MAYAChain exploit.
When a blockchain rolls back: the Harmony ONE exploit and the cost of recovery
What Harmony's planned rollback after unauthorized ONE issuance teaches protocol teams about finality, operational disruption, and incident readiness.
Ethernaut Level 2 Walkthrough: Exploiting a Misnamed Constructor in Solidity
In this article, we will analyze and solve Ethernaut Level 2: Fallout.