Pinned Tweet
1/
we found a bug in the Aptos Move VM that put up to $70B at systemic risk. type confusion at the execution layer. a ~90% success rate across hundreds of simulated runs on a 30+ validator cluster. cost to build the attack infrastructure: $3,000.
Conducted by @kemmio , to our knowledge this is the first public research that showcases how to land a sophisticated multi-block attack in real-world environments. It includes mempool feng shui, block production specifics and about a dozen of other primitives and tricks chained to get to near-perfect exploitation results.
Nonetheless, Aptos called it "extremely low exploitability."
[hexens.io/research/aptos-hij…]
Audit Completed: @KyberNetwork
KyberSwap is Kyber Network’s multi-chain DEX aggregator and liquidity protocol, helping users get the best rates across chains.
We reviewed their new conditional swap hook, which lets swaps execute only when user-defined conditions are met, along with the related liquidity contracts.
Wishing the team the best as they keep building.
Full report below:
An audit covers the contracts you wrote. An allocator’s risk mostly sits in the ones it didn’t.
@thesauros_one now has eyes on both.
Allocating into lending markets you didn't write means inheriting their risk. @thesauros_one now has Glider Monitor covering that risk.
Thesauros allocates across whitelisted lending markets, with every whitelist change timelocked before it takes effect.
Glider Monitor maps their dependency graph, watches the invariants of the markets they allocate into, and checks their contracts against new exploits as they surface.
Set up your monitoring in minutes:
hexens.io/solutions/glider-m…
New in Builder Support: @Vanarchain
Teams in the program get 7,000 credits on Vanar Foundry to spin up an AI Organisation: agents for marketing, support, BD, SEO and reporting, run from one workspace.
Link to apply to Builder Support below.
Security doesn’t stop at the audit report.
Glider Monitor is how we cover contracts after they go live, and now every team launching with @ventari_io gets discounted access to it.
An audit checks your code before launch. Launch day is when it meets real users and real attackers.
We’re partnering with @ventari_io , who take Web3 teams from tokenomics to TGE and beyond.
Every Ventari client now gets discounted access to Glider Monitor: continuous monitoring of live contracts from day one
Set up your monitoring in minutes:
hexens.io/solutions/glider-m…
How many addresses does your contract actually depend on?
You can now check it on our site. Paste any contract address and see the number.
We checked this across all teams on Glider Monitor.72% have more addresses in their dependency graph than contracts they deployed.
For about one in four, it’s 10 or more addresses for every contract they wrote.
One team has a single contract and 219 addresses behind it.
Another has 7 contracts and 875.
Another has 16 and 1,288.
Those addresses are price feeds, stablecoins, staking tokens, pools and lending markets.
Any of them can change without the team shipping a single line of code.
Paste your contract and see the number:
hexens.io/solutions/glider-m…
hexens retweeted
As of Oct 23, in 8 of the 20 largest markets listed on Morpho Ethereum, a single address owes more than half the debt.
In one market with $36M borrowed, one address owes 96%. It’s a vault that pools many depositors’ money, but one decision moves all of it. Lenders there earn 4.6% a year. If that vault repays in full, their rate immediately drops to 0.04%.
In the largest market, $309M borrowed, one address owes 56%. Its full repayment would immediately take lenders from 4.5% to 1.1%.
If you lend directly into one of these markets, your yield is set by whoever borrows the most.
Glider Monitor watches that position every block and alerts you the moment it moves.
hexens retweeted
🛡️ Security is a priority we take seriously at MINT.
We’re proud to share that $MNTD has undergone a security audit by Hexens as part of our commitment to building a robust ecosystem 🤝
Audit Completed: @PlayOnMint
MNTD is the reward and utility token of the Mint ecosystem on Base, earned in-app and usable across its applications.
We covered the fixed token issuance and launch distribution flows, plus two independent staking products built for different user groups.
Wishing the team the best as they keep building.
Full report below:
Audit Completed: @PlayOnMint
MNTD is the reward and utility token of the Mint ecosystem on Base, earned in-app and usable across its applications.
We covered the fixed token issuance and launch distribution flows, plus two independent staking products built for different user groups.
Wishing the team the best as they keep building.
Full report below:
hexens retweeted
a great way to hedge for a protocol:
bet that you WILL be hacked
but also @DefiLlama @Trueo_ users are only going to trade when they feel more confident about the decision, and they need metrics, data, etc.
we are ready to provide real-time data on the risk surface for each of protocol entry (dependency graph, recursively analyzed risks, audits, lots of other metrics)
For free.
You can now trade protocol revenue and exploit odds. We're partnering with Trueo to launch new prediction markets that settle based on DefiLlama data.
Revenue Markets
If you follow the revenue meta, you can now trade that directly on Trueo. We launched markets for Hyperliquid, Pump, Aero, Uniswap, Collector Crypt, and Papertrade revenue.
Exploit Markets
Hedge against exploit risk by trading the odds of total DeFi hacks and exploits of specific protocols. We have markets for whether there will be exploits of Aave and Morpho this month. We also have weekly and monthly markets for the size of the largest hack.
Other Onchain Metrics
Robinhood Chain RWA mcap, Robinhood Chain DEX volume, and whether Solana or Base ends the week with higher TVL.
defillama.com/predictions
Two MetaMorpho vaults had $3M in one Morpho market last October.
On October 28 borrowing jumped from $10M to $23M in under a day.
A Glider Monitor rule on borrow spikes would have fired at 17:45 UTC that day. That’s 55 hours before the cash ran out.
By the next morning the market held $2.6M to $3M in cash, and kept it for 43 hours.
Enough to take almost everything out.
One depositor got out. On October 30 they pulled $180,000.
On October 31 at 00:38 UTC a single block took the cash from $2.59M to $99.
The rest is still sitting there.
On paper, unpaid interest has grown it to $932M.
Right now $0 of it can be withdrawn.
The larger vault’s own totalAssets() kept rising the entire time.
Looking only at the vault, nothing looked wrong.
Set up your monitoring in minutes:
hexens.io/solutions/glider-m…
Audit Completed: @UFarmDigital
Tokenized RWA strategies are going live on UFarm.Digital, built on the ERC-3643 permissioned token standard with on-chain investor eligibility and transfer restrictions.
We reviewed the RWA infrastructure behind it: the ERC-3643 token suite, the identity and compliance modules, the factory that deploys a token suite per asset, the private credit token with its investment and withdrawal settlement flows, and the fixed-price sale contract.
Wishing the team the best as they keep building.
Full report below:
