Things I build, break, fix, and write about

I tested AI pentest platforms against live web apps and checked every finding by hand, because confidence is cheap and reproduction is not. The real question is not how much they report, but how much...

WrappedADS wrapTo mint path looks tidy on paper, but the trace tells a sharper story. The mint happens before the allowance moves, and that means the real question is who was allowed to call it, not...

SEA settlement adapter rounding logic turned a fixed USDT lot into too much SEA, and the loop only worked because the state kept pretending nothing had changed. I have seen enough accounting bugs to...

I spent more time than I wanted tracing Ethereum bridge proof verification through the dispatcher, and the uncomfortable bit is simple, the proof path and the payout path were effectively the same...

spot-price oracle manipulation is not a theoretical edge case, it is what happens when a vault trusts raw reserves as if they were market truth. I have seen enough broken staking logic to know the...

SquidRouterModule express path looked tidy until I traced the forged sourceAddress and a zero-amount call straight through to Safe actions. Once attacker-controlled bytes were trusted for the delegate...

EvidenceForge treats synthetic security logs as a state problem, not a formatting exercise. If the same host, process, and logon wander between sources, the whole thing feels false, and I have seen...

I’ve seen parser bugs end up in places they had no business being, and MediaInfoLib heap-based buffer overflows are exactly the sort of mess that starts with a media file and ends with a much bigger...

Stay updated with the latest in tech! This digest covers AI ethics, auto industry shifts, and the impact of politics on technology, exploring today's pressing issues.

Orthanc does not get to be picky, so the upload path is where the trouble starts. A DICOM heap overflow is rarely elegant, it usually begins with one bad length field, one careless allocation, and a...