Public smart-contract security research, educational case studies, and sanitized audit material.
⚠️ Disclaimer: Nothing in this repository should be interpreted as a guarantee that a protocol is secure. All reports are labeled by their source and scope.
Each report separates the root cause, attack path, impact, and remediation. The report type is part of the claim: educational examples are not presented as production findings, while independent and contest-based work identifies its provenance and scope.
| # | Report | Type | Severity | Status |
|---|---|---|---|---|
| 001 | Reentrancy Demo | Educational case study | High | ✅ Complete |
| 002 | tx.origin Authorization Bypass | Educational case study | High | ✅ Complete |
| 003 | Stale Oracle Data | Educational case study | Context-dependent | ✅ Complete |
| 004 | Flash Loan Price Manipulation | Independent research | High | ✅ Complete |
| 005 | Privileged Mint via Access Control Flaw | Independent research | Critical | ✅ Complete |
| 006 | ERC-4626 First-Depositor Inflation Attack | Educational case study | Medium | ✅ Complete |
| 007 | Rounding Direction Errors in Liquidity Math | Educational case study | Low | ✅ Complete |
| 008 | Unchecked Low-Level Call Return Value | Educational case study | Medium | ✅ Complete |
| 009 | EIP-712 Signature Replay Across Chains and Nonces | Independent research | High | ✅ Complete |
| 010 | Uninitialized UUPS Proxy Takeover | Independent research | Critical | ✅ Complete |
| 011 | Unbounded Loop Denial of Service | Educational case study | Medium | ✅ Complete |
| 012 | Fee-on-Transfer Token Accounting Break | Educational case study | Medium | ✅ Complete |
| 013 | Storage Layout Collisions in Upgradeable Proxies | Educational case study | Critical | ✅ Complete |
| 014 | Sandwich MEV via Missing Slippage Protection | Educational case study | Medium | ✅ Complete |
| 015 | _coming soon_ — Cross-Chain Message Replay |
Independent research | High | 📋 Planned |
Most reports are backed by a runnable Foundry lab (vulnerable + remediated contracts, exploit and regression tests) in evm-audit-lab:
| Report | Lab | Runnable PoC |
|---|---|---|
| 001 — Reentrancy Demo | lab-01-reentrancy | forge test --match-contract ReentrancyTest |
| 002 — tx.origin Authorization Bypass | lab-02-tx-origin | forge test --match-contract TxOriginTest |
| 003 — Stale Oracle Data | lab-04-oracle-manipulation | forge test --match-contract StaleOracleTest |
| 004 — Flash Loan Price Manipulation | lab-03-flash-loan | forge test --match-contract FlashLoanTest |
| 005 — Privileged Mint via Access Control Flaw | lab-09-privileged-mint | forge test --match-contract PrivilegedMintTest |
| 006 — ERC-4626 First-Depositor Inflation Attack | lab-11-erc4626-inflation | forge test --match-contract InflationAttackTest |
| 007 — Rounding Direction Errors in Liquidity Math | lab-05-integer-precision-loss | forge test --match-contract PrecisionTest |
| 008 — Unchecked Low-Level Call Return Value | lab-10-unchecked-return-value | forge test --match-contract UncheckedReturnTest |
| 009 — EIP-712 Signature Replay | lab-08-signature-replay | forge test --match-contract SignatureReplayTest |
| 010 — Uninitialized UUPS Proxy Takeover | lab-14-uups-initializer | forge test --match-contract UupsTakeoverTest |
| 011 — Unbounded Loop Denial of Service | lab-12-loop-dos | forge test --match-contract LoopDoSTest |
| 012 — Fee-on-Transfer Token Accounting Break | lab-13-fee-on-transfer | forge test --match-contract FeeOnTransferTest |
| 013 — Storage Layout Collisions in Upgrades | lab-07-proxy-storage-collision | forge test --match-contract ProxyCollisionTest |
| 014 — Sandwich MEV via Missing Slippage Protection | lab-06-sandwich-mev | forge test --match-contract SandwichTest |
The repository also includes longer-form technical writing derived from the research archive. These articles are written for readers who want the security concept and its practical implications explained without the full report structure.
| Article | Topic | Related research |
|---|---|---|
| How Missing Slippage Protection Turns an AMM Swap into a Sandwich Target | AMM · MEV · slippage protection | Report 014 · Lab 06 |
The review process follows a structured pipeline:
- Scope & trust boundaries — Identify privileged actors, external dependencies, and assets at risk.
- Invariants & assumptions — Document protocol invariants and threat model before code review.
- Manual review — Trace privileged flows, accounting, external calls, oracle dependencies, and upgrade paths.
- Static analysis — Run Slither and complementary tooling. Treat all tool output as a lead, not a finding.
- Reproduction — Reproduce material findings with a minimal Foundry test or PoC.
- Impact analysis — Describe exploitability and impact precisely, without overstating claims.
- Remediation — Propose a narrow fix and verify it with regression tests.
Foundry · Slither · Hardhat · Echidna (where applicable) · Python (custom analysis)
| Report type | Disclosure |
|---|---|
| Client-approved | Sanitized to remove private information, credentials, sensitive addresses, and weaponized exploit details. Published only with explicit authorization. |
| Contest-based | Sourced from public audit contests (Code4rena, Sherlock, Cantina). The contest handle is identified, and the scope is documented. |
| Educational | Original, self-authored examples designed to teach a specific vulnerability class. No production protocol is described. |
| Independent research | Public post-mortems of real incidents, written from public on-chain data and disclosed reports. No private information is used. |
.
├── 001-reentrancy-demo.md
├── 002-tx-origin-access-control.md
├── 003-stale-oracle.md
├── templates/
│ ├── report-template.md # standard report template
│ └── severity-matrix.md # severity rubric
├── LICENSE
└── README.md
This repository is primarily a personal research archive. If you spot an error in a report or want to suggest an improvement:
- Open an issue describing the discrepancy.
- Reference the report number (
001,002, …) and the specific claim you believe is incorrect. - Provide a source (Code4rena report, Etherscan tx, Slither output) supporting your correction.
For security research, collaboration, or audit inquiries:
- X: @DeFiAudit
- Telegram: @DefiAudit0x
- Email: defiaudit@gmail.com
MIT — Educational and research material. Weaponized exploit code is intentionally omitted.