Security Research & Vulnerability Disclosures

Original vulnerability research, responsible disclosures, and security publications from the team behind 300+ engagements and zero client exploits.
Arbitrary Struct Hijack in Aptos Move VM

Jul 4, 2026

Arbitrary Struct Hijack in Aptos Move VM

TL;DR -- A stale type-tag cache in the Aptos Move VM lets a recycled `StructNameIndex` map to the wrong `StructTag` after a partial cache flush, enabling storage-level type confusion. An attacker aligns a look-alike struct onto a victim resource and reads/writes its storage slot -- draining vaults, stealing capabilities, and forging cross-chain messages. Severity: Critical.

Read more
Tricking the Polygon bridge into withdrawals by forging transaction proofs

Mar 4, 2026

Tricking the Polygon bridge into withdrawals by forging transaction proofs

This is a disclosure of a vulnerability in the Polygon Plasma bridge. The vulnerability has been fixed since July 2024 and the fix has been pushed to the vulnerable library as well.

Read more
TSTORE Poison: The Solidity Compiler Bug That Silently Corrupts Storage

Feb 18, 2026

TSTORE Poison: The Solidity Compiler Bug That Silently Corrupts Storage

TL;DR -- A cache key collision in the Solidity compiler's via-ir code generator causes `delete` on transient variables to emit `sstore` instead of `tstore`, or conversely causes persistent `delete` to emit `tstore` instead of `sstore`. The direction depends on function selector ordering -- neither direction is safe.

Read more