Smart contract audits from Veridise https://veridise.com/ Fri, 25 Sep 2026 02:23:13 +0000 en-US hourly 1 https://wordpress.org/?v=7.1 https://veridise.com/wp-content/uploads/2024/01/Symbol-on-light-bg-copy-150x150.png Smart contract audits from Veridise https://veridise.com/ 32 32 When a Contract Trusts the Caller’s Encoding https://veridise.com/blog/audit-insights/arbitrary_external_call_injection_socket_exploit/ Wed, 16 Sep 2026 14:12:25 +0000 https://veridise.com/?p=20544 When a Contract Trusts the Caller’s Encoding

When a Contract Trusts the Caller’s Encoding

The Auditor's Take is a weekly series by Jon Stephens, CEO of Veridise. This one covers arbitrary external call injection, where a contract performs an action on a caller's behalf without checking what that action is. Each week's take goes out at @FormallyJon.

Arbitrary external call injection is what happens when a contract builds an external call out of arguments its...

Read More →

]]> When a Contract Trusts the Caller’s Encoding

When a Contract Trusts the Caller’s Encoding

The Auditor's Take is a weekly series by Jon Stephens, CEO of Veridise. This one covers arbitrary external call injection, where a contract performs an action on a caller's behalf without checking what that action is. Each week's take goes out at @FormallyJon. Arbitrary external call injection is what happens when a contract builds an external call out of arguments its...

Read More →

]]> Reentrancy in Reward Accounting: How $27M Was Paid Out on a Deposit https://veridise.com/blog/audit-insights/reentrancy_reward_accounting_penpie_27m_exploit/ Tue, 01 Sep 2026 14:54:57 +0000 https://veridise.com/?p=20528 Reentrancy in Reward Accounting: How $27M Was Paid Out on a Deposit

Reentrancy in Reward Accounting: How $27M Was Paid Out on a Deposit

The Auditor's Take is a weekly series by Jon Stephens, CEO of Veridise. This one is about a reentrancy bug, and about what a reward calculation measures when it subtracts two balances. There is a new one each week, and Jon posts them at @FormallyJon.

Penpie accepted Pendle market LP tokens and paid depositors the rewards those tokens earned, boosted above...

Read More →

]]> Reentrancy in Reward Accounting: How $27M Was Paid Out on a Deposit

Reentrancy in Reward Accounting: How $27M Was Paid Out on a Deposit

The Auditor's Take is a weekly series by Jon Stephens, CEO of Veridise. This one is about a reentrancy bug, and about what a reward calculation measures when it subtracts two balances. There is a new one each week, and Jon posts them at @FormallyJon. Penpie accepted Pendle market LP tokens and paid depositors the rewards those tokens earned, boosted above...

Read More →

]]> Veridise Audits the Strategy Contracts Behind Lombard’s Bitcoin Vaults https://veridise.com/blog/audits-archive/lombard_smart_contract_audit_strategy_vault/ Fri, 28 Aug 2026 13:25:33 +0000 https://veridise.com/?p=20522 Veridise Audits the Strategy Contracts Behind Lombard’s Bitcoin Vaults

Veridise Audits the Strategy Contracts Behind Lombard’s Bitcoin Vaults

Lombard has launched an on-chain vault system where risk curators and asset managers offer Bitcoin yield products to users through a single vault deposit. Veridise audited the smart contracts behind that vault infrastructure, the strategy logic, blocklist, converters, shards, and validator, pairing manual review with property-based fuzz testing. The review found one high-severity bug, since fixed, and fixed 14 findings...

Read More →

]]> Veridise Audits the Strategy Contracts Behind Lombard’s Bitcoin Vaults

Veridise Audits the Strategy Contracts Behind Lombard’s Bitcoin Vaults

Lombard has launched an on-chain vault system where risk curators and asset managers offer Bitcoin yield products to users through a single vault deposit. Veridise audited the smart contracts behind that vault infrastructure, the strategy logic, blocklist, converters, shards, and validator, pairing manual review with property-based fuzz testing. The review found one high-severity bug, since fixed, and fixed 14 findings...

Read More →

]]> ZK Circuit Equivalence Checking: Introducing LLEQ https://veridise.com/blog/research/zk-circuit-equivalence-checking-introducing-lleq/ Tue, 25 Aug 2026 13:54:51 +0000 https://veridise.com/?p=20508 ZK Circuit Equivalence Checking: Introducing LLEQ

ZK Circuit Equivalence Checking: Introducing LLEQ

Every ZK circuit is written twice. The witness generator evaluates the computation and assigns concrete values to the circuit's signals, and the constraints are polynomial equations that decide whether a given assignment gets accepted. A developer writes both, often on adjacent lines of the same file. The prover runs the witness generator to produce a set of signal values, and...

Read More →

]]> ZK Circuit Equivalence Checking: Introducing LLEQ

ZK Circuit Equivalence Checking: Introducing LLEQ

Every ZK circuit is written twice. The witness generator evaluates the computation and assigns concrete values to the circuit's signals, and the constraints are polynomial equations that decide whether a given assignment gets accepted. A developer writes both, often on adjacent lines of the same file. The prover runs the witness generator to produce a set of signal values, and...

Read More →

]]> Constant Product Manipulation: When a Token Breaks the Pool It Was Built For https://veridise.com/blog/audit-insights/constant-product-manipulation-future-protocol-exploit/ Wed, 19 Aug 2026 16:35:56 +0000 https://veridise.com/?p=20500 Constant Product Manipulation: When a Token Breaks the Pool It Was Built For

Constant Product Manipulation: When a Token Breaks the Pool It Was Built For

The Auditor's Take is a weekly series by Jon Stephens, CEO of Veridise. This article is about a class of bug where a token's own transfer logic breaks an invariant of the protocol it was written to work with. New take every week. Find Jon at @FormallyJon.

Custom token implementations that add fees or constraints to events like transfers, mints and...

Read More →

]]> Constant Product Manipulation: When a Token Breaks the Pool It Was Built For

Constant Product Manipulation: When a Token Breaks the Pool It Was Built For

The Auditor's Take is a weekly series by Jon Stephens, CEO of Veridise. This article is about a class of bug where a token's own transfer logic breaks an invariant of the protocol it was written to work with. New take every week. Find Jon at @FormallyJon. Custom token implementations that add fees or constraints to events like transfers, mints and...

Read More →

]]> Mina Multisig Audit: Veridise Reviews FROST Signing https://veridise.com/blog/audits-archive/mina_multisig_audit_frost_signature/ Tue, 11 Aug 2026 16:18:24 +0000 https://veridise.com/?p=20478 Mina Multisig Audit: Veridise Reviews FROST Signing

Mina Multisig Audit: Veridise Reviews FROST Signing

Mina Multisig lets Mina and ecosystem projects operate through a threshold signature instead of a single key, adapting the FROST protocol to Mina's Pallas curve and Poseidon hashing. Veridise completed a manual audit of that implementation in June 2026, reviewing the two Rust crates that turn FROST's signing flow into Mina-compatible signatures. The audit found six issues, all fixed, before...

Read More →

]]> Mina Multisig Audit: Veridise Reviews FROST Signing

Mina Multisig Audit: Veridise Reviews FROST Signing

Mina Multisig lets Mina and ecosystem projects operate through a threshold signature instead of a single key, adapting the FROST protocol to Mina's Pallas curve and Poseidon hashing. Veridise completed a manual audit of that implementation in June 2026, reviewing the two Rust crates that turn FROST's signing flow into Mina-compatible signatures. The audit found six issues, all fixed, before...

Read More →

]]> Low-Level Call Hijacking: How a Trusted Router Call Cost $3.5M https://veridise.com/blog/audit-insights/low_level_call_hijacking_arcadia_exploit/ Wed, 05 Aug 2026 13:56:52 +0000 https://veridise.com/?p=20471 Low-Level Call Hijacking: How a Trusted Router Call Cost $3.5M

Low-Level Call Hijacking: How a Trusted Router Call Cost $3.5M

The Auditor's Take is a weekly series by Jon Stephens, CEO of Veridise. This one is about privileged contracts that forward caller-supplied data straight into a low-level call, and how a senior auditor catches the bug before it ships. New take every week, and you can follow Jon at @FormallyJon.

A protocol can define exactly which contracts may act on its...

Read More →

]]> Low-Level Call Hijacking: How a Trusted Router Call Cost $3.5M

Low-Level Call Hijacking: How a Trusted Router Call Cost $3.5M

The Auditor's Take is a weekly series by Jon Stephens, CEO of Veridise. This one is about privileged contracts that forward caller-supplied data straight into a low-level call, and how a senior auditor catches the bug before it ships. New take every week, and you can follow Jon at @FormallyJon. A protocol can define exactly which contracts may act on its...

Read More →

]]> Insolvency Vulnerability: The Euler Finance $197M Exploit https://veridise.com/blog/audit-insights/insolvency-vulnerability-euler-finance-exploit/ Tue, 28 Jul 2026 14:08:39 +0000 https://veridise.com/?p=20391 Insolvency Vulnerability: The Euler Finance $197M Exploit

Insolvency Vulnerability: The Euler Finance $197M Exploit

The Auditor's Take is a weekly series by Jon Stephens, CEO of Veridise. This article is about a solvency invariant that was correctly enforced until a later upgrade, an upgrade that was itself audited. New take every week. Find Jon at @FormallyJon.

A protocol can run the same safety check in every function that moves user funds, then add one new...

Read More →

]]> Insolvency Vulnerability: The Euler Finance $197M Exploit

Insolvency Vulnerability: The Euler Finance $197M Exploit

The Auditor's Take is a weekly series by Jon Stephens, CEO of Veridise. This article is about a solvency invariant that was correctly enforced until a later upgrade, an upgrade that was itself audited. New take every week. Find Jon at @FormallyJon. A protocol can run the same safety check in every function that moves user funds, then add one new...

Read More →

]]> Flash Loan Governance Attacks: How Borrowed Voting Power Drains a Protocol https://veridise.com/blog/audit-insights/flash_loan_governance_vulnerability_beanstalk_182m/ Tue, 21 Jul 2026 13:48:20 +0000 https://veridise.com/?p=20343 Flash Loan Governance Attacks: How Borrowed Voting Power Drains a Protocol

Flash Loan Governance Attacks: How Borrowed Voting Power Drains a Protocol

The Auditor's Take is a weekly series by Jon Stephens, CEO of Veridise. This week's edition looks at how governance systems that measure voting power instantaneously, rather than from a fixed checkpoint, become exploitable the moment flash loan liquidity is large enough to buy a temporary supermajority, even for a single block. Jon publishes one of these every week; follow...

Read More →

]]> Flash Loan Governance Attacks: How Borrowed Voting Power Drains a Protocol

Flash Loan Governance Attacks: How Borrowed Voting Power Drains a Protocol

The Auditor's Take is a weekly series by Jon Stephens, CEO of Veridise. This week's edition looks at how governance systems that measure voting power instantaneously, rather than from a fixed checkpoint, become exploitable the moment flash loan liquidity is large enough to buy a temporary supermajority, even for a single block. Jon publishes one of these every week; follow...

Read More →

]]> Bridge Misconfiguration Vulnerabilities: How One Zero Value Cost $190M https://veridise.com/blog/audit-insights/bridge_misconfiguration_nomad_190m_exploit/ Wed, 15 Jul 2026 13:06:07 +0000 https://veridise.com/?p=20285 Bridge Misconfiguration Vulnerabilities: How One Zero Value Cost $190M

Bridge Misconfiguration Vulnerabilities: How One Zero Value Cost $190M

The Auditor's Take is a weekly series by Jon Stephens, CEO of Veridise. This one is about configuration bugs that live in a value set at deployment rather than in the code itself, and how a senior auditor catches them. New take every week. Find Jon at @FormallyJon.

A protocol can audit its code, ship sound validation logic, and still introduce...

Read More →

]]> Bridge Misconfiguration Vulnerabilities: How One Zero Value Cost $190M

Bridge Misconfiguration Vulnerabilities: How One Zero Value Cost $190M

The Auditor's Take is a weekly series by Jon Stephens, CEO of Veridise. This one is about configuration bugs that live in a value set at deployment rather than in the code itself, and how a senior auditor catches them. New take every week. Find Jon at @FormallyJon. A protocol can audit its code, ship sound validation logic, and still introduce...

Read More →

]]>