VS Code extensions run with your permissions while installs and badges are weak trust signals. Learn how to audit, pin, allowlist, and contain them.
Research author
Naoki Yoshida
Security researcher focused on fuzz testing, Solidity, and the tooling that makes complex failures reproducible.
A staged workflow for reviewing unfamiliar repositories with AI agents using read-only mounts, no credentials, restricted networks, and disposable sandboxes.
Code corpora and current benchmarks show why AI-assisted Solidity tests benefit from Python, while human review stays focused on test logic.
Master Wake's debugging tools: console logging, Python fuzzing, ipdb integration, and performance profiling for Solidity smart contract development.
Inspect EIP-712 type strings and preimage bytes in Wake to match Solidity exactly, catch schema errors early, and prove signatures before deployment.
Test upgradable proxy contracts in Wake's Python framework. Catch initialization bugs, storage collisions, and access control issues before mainnet.
Learn how to sign raw, structured, and hashed messages in Wake tests. Validate EIP-712, EIP-191, and permit flows with clear examples and reliable verification.
Learn how Balancer’s StableSwap math failed and how differential fuzzing in Python detects precision bugs in DeFi swap logic for safer smart contract design.
Learn how to build custom Wake printers for smart contract analysis, uncover vulnerabilities, and speed up Solidity security reviews.
Boost smart contract security with AI-guided fuzz testing in Wake. Learn what to automate, what to verify, and how to write effective tests in Python.
Comparing how Foundry, Echidna, and Wake shrink fuzzing failures. Learn which tool offers the best balance of speed, precision, and debugging clarity.
Learn Manually Guided Fuzzing (MGF) with the Wake framework to find critical smart contract vulnerabilities through systematic testing and defined invariants.
Learn how Wake's Manually Guided Fuzzing detects front-running vulnerabilities using differential fuzzing. Includes real examples and best practices.
This guide provides a comprehensive analysis of reentrancy vulnerabilities with examples. Learn how reentrancy works and how to identify it in real protocols.
Learn how attackers can exploit reentrancy vulnerabilities in ERC-1155 implementations to drain vault contracts, with an example real-world attack scenario.
In this article, we'll examine how attackers can manipulate the _safeMint function's external call to bypass minting limits and drain NFT collections.
This analysis examines the 42M attack on the GMX protocol. We provide details of the vulnerability with a working reproduction of the attack scenario.
In this blog, we describe reentrancy attacks in the ERC-777 standard. ERC-777 is a standard for fungible tokens with a hook for transferring – learn more here.
Flash loans enable borrowing without collateral and repaying within a single transaction. While effective, they also introduce security risks – learn more here.
A cross-chain reentrancy attack is an exploit that targets smart contract function calls. Learn about this vulnerability to keep your code safe from attackers.
A read-only reentrancy attack manipulate a smart contracts to extract value. Let's take a closer look at this vulnerability and how to prevent it.
This research article reviews how cross contract reentrancy attacks work, an attack example, and guidance on how to prevent cross contract reentrancy attacks.…
What is a cross function reentrancy attack? Cross-function reentrancy attacks use multiple functions to execute the attack, which can occur when inappropriate…
![The vulnerable Vault withdrawal code beside a recursive call-stack graph showing repeated withdraw frames reading the same balance before any frame reaches balances[msg.sender] equals zero.](/_astro/hero.BjCEFGsd_2u77Pn.png)
What is a reentrancy attack? A reentrancy attack is very specific to smart contracts due to the nature of external calls. When a contract interacts with another…