February 2026 · 5 MIN · INDUSTRY · AUDIT
Web3 Security M&As and IPOs
How consolidation is reshaping the web3 security market, and what the wave of acquisitions and public listings means for protocols choosing an auditor.
How consolidation is reshaping the web3 security market, and what the wave of acquisitions and public listings means for protocols choosing an auditor.
Most DeFi protocols are not purely onchain. This walks through a real vulnerability in the seam between backend and contract, where smart contract auditors and backend developers each assume the other has it covered.
Anchor's account constraints are used by almost every Solana program, and misreading them is a recurring source of critical bugs. A practical guide to auditing them.
Original research measuring the interval between a vulnerable contract's deployment and its exploitation, from 2020 onward. Full dataset at time-to-hack.decurity.io.
IDA had no support for Solana's eBPF target, so we built it. A walkthrough of reverse-engineering deployed Solana programs without source.
A postmortem of one of the toughest DeFi exploits of 2025: how a Yul assembly calldata handling bug in a 1inch resolver contract was exploited, and what the class of bug looks like.
The GemPad hack reconstructed from the attacker's point of view, step by step, rather than from the defender's — including how the vulnerability would have been found.
A survey of the web3 and DeFi security product market: what the tooling actually does, where it falls short, and why building products in this space is hard.
Defining the Web2.5 attack surface: the centralised backends, APIs and infrastructure that DeFi protocols depend on but that smart contract audits do not cover.
The security model of automated market makers, traced from the constant-product algorithm through concentrated liquidity, with the vulnerability classes each design introduces.
How a researcher looked at a seemingly random contract and prevented a $5.2M drain hours later — the disclosure, the timeline, and the response.
The architecture of liquid staking derivatives and the vulnerability classes specific to them: reward accounting, withdrawal queues, and validator trust assumptions.
The security of the collateralized debt position pattern: liquidation logic, oracle dependence, interest accrual, and the bug classes each introduces.
A Paradigm CTF write-up from the engagement where Decurity placed 2nd of more than 400 teams: exploiting a GSN-enabled multisig to drain gas tokens.
A critical bug found during the Giveth audit that allowed staking rewards to be claimed out of thin air from a contract already deployed in production.
Ambiguity in the ERC721 specification produces exploitable implementation differences. How we scanned the chain for them, and what we found.
Interactive studies built from our own datasets, each on its own site.
The people who write this research are the people who run the audits.