hexens retweeted
As of Oct 23, in 8 of the 20 largest markets listed on Morpho Ethereum, a single address owes more than half the debt.
In one market with $36M borrowed, one address owes 96%. It’s a vault that pools many depositors’ money, but one decision moves all of it. Lenders there earn 4.6% a year. If that vault repays in full, their rate immediately drops to 0.04%.
In the largest market, $309M borrowed, one address owes 56%. Its full repayment would immediately take lenders from 4.5% to 1.1%.
If you lend directly into one of these markets, your yield is set by whoever borrows the most.
Glider Monitor watches that position every block and alerts you the moment it moves.
hexens retweeted
🛡️ Security is a priority we take seriously at MINT.
We’re proud to share that $MNTD has undergone a security audit by Hexens as part of our commitment to building a robust ecosystem 🤝
Audit Completed: @PlayOnMint
MNTD is the reward and utility token of the Mint ecosystem on Base, earned in-app and usable across its applications.
We covered the fixed token issuance and launch distribution flows, plus two independent staking products built for different user groups.
Wishing the team the best as they keep building.
Full report below:
hexens retweeted
a great way to hedge for a protocol:
bet that you WILL be hacked
but also @DefiLlama @Trueo_ users are only going to trade when they feel more confident about the decision, and they need metrics, data, etc.
we are ready to provide real-time data on the risk surface for each of protocol entry (dependency graph, recursively analyzed risks, audits, lots of other metrics)
For free.
You can now trade protocol revenue and exploit odds. We're partnering with Trueo to launch new prediction markets that settle based on DefiLlama data.
Revenue Markets
If you follow the revenue meta, you can now trade that directly on Trueo. We launched markets for Hyperliquid, Pump, Aero, Uniswap, Collector Crypt, and Papertrade revenue.
Exploit Markets
Hedge against exploit risk by trading the odds of total DeFi hacks and exploits of specific protocols. We have markets for whether there will be exploits of Aave and Morpho this month. We also have weekly and monthly markets for the size of the largest hack.
Other Onchain Metrics
Robinhood Chain RWA mcap, Robinhood Chain DEX volume, and whether Solana or Base ends the week with higher TVL.
defillama.com/predictions
hexens retweeted
Audit complete ✅
Thanks to the @hexens team for a thorough review of our contracts.
Next: Launch 🚀
Audit Completed: @tmrwcredit
TMRW is a yield-bearing digital asset powered by the earnings of the creator economy.
We covered the vault deposit and withdrawal queue, the fee controller and high-water mark logic, oracle price normalization, and the borrower funding and repayment flows.
Wishing the team the best as they keep building.
Full report below:
hexens retweeted
Security check: done 🛡️🐰
SquadSwap Thanos (V4) + ALM has been audited by @hexens
Core systems reviewed. Findings addressed and verified.
We keep building 💚
Full report 👇
hexens retweeted
Also this week:
🔓 @hexens Wasmer sandbox escape to RCE
⚡ Core Lightning warns of node attacks
🎣 LinkedIn job scams and Gmail-to-fake-support social engineering
🍎 A new MacSync stealer hunting crypto devs
💸 A Robinhood Chain rug factory moving $9M+ in 30 days
hexens retweeted
4/ Risk monitoring runs around the clock. Zyfai tracks:
→ TVL drawdowns
→ APY fluctuations
→ Liquidity traps
→ Vault share concentration
→ Depegs
→ FUD on X
→ Underlying collateral health and changes
Last week, we strengthened our risk engine with @hexens' Glider Monitor, adding real-time attack detection, vulnerability checks and custom monitoring rules across all 80+ supported pools, alongside a dependency graph that maps their underlying contracts to identify which pools could be affected by a problem in a dependency.
hexens retweeted
🗳️ New Proposal for Safenet Aegis is now live on the Safe{DAO} forum. Here is a breakdown ↓
It asks to fund the first production-ready protocol version built to secure @safe Multisig and the wider ecosystem in Q4.
Threats to self-custody are only increasing, and most defences today are still just warnings, not enforcement. Safenet Aegis is changing that paradigm.
🔰 Safenet is a decentralized network of independent Sentinels and Validators
📜 Sentinels check every transaction against a public, DAO-owned charter using their own proprietary threat detection systems
🧾 Sentinels pass verdicts. Verdicts are attested by validators onchain making security enforceable
🛡️ Enforcement happens at the account level via Safenet Guards
Proposed Independent Sentinels checking transactions: @OpenCover, @IntentGuard , @hackenclub, @hexens, @BlockSecTeam and @candidelabs
Proposed Validators: @gnosisdao, Core Contributors, @greenfield_cap, @SafeLabs_, @RockawayX and @bcap
Safe{DAO} through this proposal, owns every fee parameter on the Safenet protocol. Safenet Aegis will ship inside @SafeLabs_ multisigs in Q4 2026.
Read More ↓
Draft Proposal for Safenet is live on the Safe{DAO} forum for discussion:
It asks to fund Safenet Aegis: The first production-ready protocol release to secure the @safe ecosystem and the first, with onchain fees paid to participants in the network.
Read More: forum.safefoundation.org/t/d…
hexens retweeted
Pegged swap pricing, decay, fees and external calls each affect how a swap fills. @Hexens audited these production paths in SwapVM.
One of 8 independent Aqua and SwapVM audits, all public 👇
Audit Completed: @1inch
Aqua and Swap VM, a bytecode engine where makers compose swap strategies from individual instructions.
Across two reviews we looked at PeggedSwap pricing, decay offsets, protocol fee ordering and the external call surface, plus the SplineSwap update.
Wishing the team the best as they keep building.
Full reports below:
hexens retweeted
Institutional capital requires security controls that operate continuously rather than a one time snapshot.
At Vault Street, continuous monitoring is part of the infrastructure protecting capital from day one.
Glider Monitor continuously checks our contracts and their dependencies, monitors critical invariants and real-time activity, and can replay newly discovered exploits against our contracts to identify exposure to emerging attack vectors.
This sits alongside audits, access controls, onchain limits and automated circuit breakers as part of our defense in depth approach.
The risk landscape is dynamic and our security infrastructure is built to be the same.
Allocated capital needs continuous coverage, not a one-time assessment. That’s why @Vault_St launched with Glider Monitor in place from day one
primeUSD is an investment-grade fixed-income vault: tokenized US Treasuries, AAA rated structured credit.
Glider Monitor checks their contracts against new vulnerabilities as they surface on mainnet, watches what they depend on, and verifies the invariants that keep Vault Street healthy.
hexens retweeted
Another important security review completed with the amazing Hexens team. Huge thanks to @hexens for the deep work, attention to detail, and for continuing to help us make UFarm.Digital stronger as we scale.
Audit Completed: @UFarmDigital
We're glad to have supported UFarm.Digital with a security review of their on-chain asset management protocol, connecting professional managers with investors through non-custodial DeFi vaults.
Our audit covered the managed vault lifecycle, the oracle-driven deposit and withdrawal flows, the CCIP cross-chain adapter, and ERC-1271 signature validation.
Their bug bounty is now live again on r.xyz, keeping the code under review beyond the audited commit.
Wishing the UFarm team the best as they continue building
Full report below:
hexens retweeted
Hexens audit is complete 👇
Full review of Flipper: position lifecycle across all four adapters, collateral vaults, oracle validation, liquidation and settlement flows
Huge respect to the @hexens team 🤝
Audit Completed: @flipper_trade
Flipper is a Solana perps aggregator routing across Adrena, Phoenix, GMTrade and Sour.
We covered the position lifecycle across all four adapters, collateral vaults, oracle validation, and the liquidation and settlement flows.
Wishing the team the best as they keep building.
Full report below:
hexens retweeted
Security is, and will always be, our highest priority.
Happy to have @hexens back once again to review Royco Day and all of its new liquidity mechanics.
Read their full report below 👇
Audit Completed: @roycoprotocol
We're glad to have supported Royco with a security review of a major refactor of Royco Day, their risk and liquidity transformation protocol. The update splits each market into three tranches, adding SLP (Senior Liquidity Provider) alongside senior and junior. SLPs provide secondary liquidity in exchange for a premium. This was our fourth engagement with Royco.
Our audit covered the senior, junior and SLP tranche accounting, the SLP premium accrual and reinvestment path, the delayed deposit and redemption entry point, and the Balancer V3 and Gyroscope E-CLP deployment templates.
Wishing the Royco team the best as they continue building
Full report below:
hexens retweeted
Big update: AnchorVaultCoin is undergoing a security audit with @Hexens io through their Builder Support Program!
As an early project, shipping safely is non-negotiable. Massive thanks to Hexens for backing early builders. Updates coming soon.
#AnchorVaultCoin #Hexens #Ethereum
It's never been harder to build or raise in crypto. And the teams that need audits the most are the ones just starting out.
Hexens Builder Support: real security engagement built around where early-stage protocols actually are.
Who qualifies:
— Under $1M raised
— First security audit (no prior professional audit)
— Live or near-launch product (not just an idea)
Too many good protocols die before their first audit or ship without one and get exploited. That's why we built Builder Support. To catch the ones worth catching, before anyone else does.
Apply: hexens.io/?request-a-quote=t…
hexens retweeted
Writing Glider queries just got dramatically easier.
We just shipped official support for Claude Code/ Codex + Glider.
Most researchers know the pattern. Reentrancy through untrusted external calls. Privileged state changes without access control. Unvalidated return values from delegatecall. The knowledge is there. The query syntax to capture it is a separate skill.
Our new updated Glider skill removes that barrier.
Describe what you want to find in plain language. Claude Code or Codex writes the Glider query. You run it. If the results need refining, describe the adjustment. The iteration happens in conversation, not in syntax rewrites.
This updated version ensures agents leverage existing Glider API libraries, uses our official Glider cheatsheet, and improves the performance of generated queries.
This skill is built for researchers who want to spend their time on what the results mean, not on how to construct the search.
Get your access below:
Pretty handy skill for your Claude Code, Codex, terminal, etc for writing glider queries for security research created by the @hexens team
i am testing it out as we speak
github.com/Hexens/glider-ski…
hexens retweeted
Real thanks to Hexens, their Builder Support program made a difference.
They took the part that actually matters in a multi-venue integrated lending protocol.
No audit is the final word on that, but this one came back clean, 4 Lows, nothing above.
We're almost ready.
Hexens Builder Support × @iris_credit
Happy to have supported IRIS through our Builder Support program, backing early-stage teams building thoughtful protocols in Web3.
Our audit focused on Iris's fixed-rate lending core. interest accrual across the fixed, floating, and overdue legs, collateral and bad-debt settlement, and the Morpho and Aave venue adapters.
Wishing the IRIS team the best as they head into launch.
Full report below:
hexens retweeted
Hexens(@hexens) researchers spent $3,000 on a server to simulate a cluster of 30+ @Aptos validator nodes. What they found: a stale-cache type-confusion bug in the Move VM that bypassed the type-system guarantees Aptos was built on.
In Move, protocol permissions — minting rights, bridge controls, admin roles — are stored as onchain resources. This bug let attacker-controlled code write into storage belonging to other contracts. The simulated success rate: 17 out of 20 attempts under mainnet-shaped conditions.
Theoretical blast radius: $70B, spanning cross-chain bridges, stablecoin infrastructure (including USDC's CCTP), and exchange deposit pathways. No funds were lost. Hexens filed the report through emergency channels on Feb 25, and a fix deployed within hours.
A patch arrived. The attacker didn't. The difference is one whitehat team that found it first.
This is the architecture argument for decoupling verification from execution. CRVA gives verification its own plane — auditable, enforced by cryptographic proof, separated from the surface where logic gaps hide.
Source:
coindesk.com/tech/2026/07/04…
#DeepSafe #CRVA #AISecurity #MoveVM #WhiteHat
