Technical articles and evidence-backed web3 security research from ack3.https://ack3.ai/enhttps://ack3.ai/research/do-not-trust-vscode-extension-install-counts/https://ack3.ai/research/do-not-trust-vscode-extension-install-counts/VS Code extensions run with your permissions while installs and badges are weak trust signals. Learn how to audit, pin, allowlist, and contain them.Tue, 14 Jul 2026 00:00:00 GMTSecurity researchdeveloper-securityextensionssupply-chainvs-codeNaoki Yoshidahttps://ack3.ai/research/how-to-review-unfamiliar-repositories-without-trusting-them/https://ack3.ai/research/how-to-review-unfamiliar-repositories-without-trusting-them/A staged workflow for reviewing unfamiliar repositories with AI agents using read-only mounts, no credentials, restricted networks, and disposable sandboxes.Mon, 13 Jul 2026 00:00:00 GMTTechnical guideai-agentscode-reviewdeveloper-securitysandboxingsupply-chainNaoki Yoshidahttps://ack3.ai/research/why-ai-assisted-smart-contract-testing-belongs-in-python/https://ack3.ai/research/why-ai-assisted-smart-contract-testing-belongs-in-python/Code corpora and current benchmarks show why AI-assisted Solidity tests benefit from Python, while human review stays focused on test logic.Wed, 08 Jul 2026 00:00:00 GMTSecurity researchaicode-generationpythonsecuritysoliditytestingwakeNaoki Yoshidahttps://ack3.ai/research/wake-debugging-guide/https://ack3.ai/research/wake-debugging-guide/Master Wake's debugging tools: console logging, Python fuzzing, ipdb integration, and performance profiling for Solidity smart contract development.Wed, 14 Jan 2026 00:00:00 GMTTechnical guideeducationethereumsoliditytutorialwakeNaoki Yoshidahttps://ack3.ai/research/eip-712-encoding-in-wake-without-guesswork/https://ack3.ai/research/eip-712-encoding-in-wake-without-guesswork/Inspect EIP-712 type strings and preimage bytes in Wake to match Solidity exactly, catch schema errors early, and prove signatures before deployment.Thu, 18 Dec 2025 00:00:00 GMTTechnical guideeducationethereumsoliditywakeNaoki Yoshidahttps://ack3.ai/research/test-proxy-contracts-safely-in-wake/https://ack3.ai/research/test-proxy-contracts-safely-in-wake/Test upgradable proxy contracts in Wake's Python framework. Catch initialization bugs, storage collisions, and access control issues before mainnet.Tue, 16 Dec 2025 00:00:00 GMTTechnical guideeducationethereumsoliditywakeNaoki Yoshidahttps://ack3.ai/research/signing-data-in-wake-raw-structured-and-hash-flows/https://ack3.ai/research/signing-data-in-wake-raw-structured-and-hash-flows/Learn how to sign raw, structured, and hashed messages in Wake tests. Validate EIP-712, EIP-191, and permit flows with clear examples and reliable verification.Wed, 10 Dec 2025 00:00:00 GMTTechnical guideeducationethereumsoliditywakeNaoki Yoshidahttps://ack3.ai/research/balancer-incident-analysis-and-differential-fuzzing/https://ack3.ai/research/balancer-incident-analysis-and-differential-fuzzing/Learn how Balancer’s StableSwap math failed and how differential fuzzing in Python detects precision bugs in DeFi swap logic for safer smart contract design.Thu, 27 Nov 2025 00:00:00 GMTIncident analysiseducationethereumexploithacksmart-contractwakeNaoki Yoshidahttps://ack3.ai/research/mastering-wake-printers-for-solidity-security-analysis/https://ack3.ai/research/mastering-wake-printers-for-solidity-security-analysis/Learn how to build custom Wake printers for smart contract analysis, uncover vulnerabilities, and speed up Solidity security reviews.Thu, 06 Nov 2025 00:00:00 GMTTechnical guideeducationethereumhackprintersecuritysmart-contractsoliditytutorialwakeNaoki Yoshidahttps://ack3.ai/research/vibe-fuzzing-guide-for-wakes-manually-guided-fuzzing/https://ack3.ai/research/vibe-fuzzing-guide-for-wakes-manually-guided-fuzzing/Boost smart contract security with AI-guided fuzz testing in Wake. Learn what to automate, what to verify, and how to write effective tests in Python.Thu, 30 Oct 2025 00:00:00 GMTTechnical guideeducationethereummgfsecuritysoliditytutorialwakeNaoki Yoshidahttps://ack3.ai/research/shrinking-algorithm-differences-between-foundry-echidna-and-wake/https://ack3.ai/research/shrinking-algorithm-differences-between-foundry-echidna-and-wake/Comparing how Foundry, Echidna, and Wake shrink fuzzing failures. Learn which tool offers the best balance of speed, precision, and debugging clarity.Tue, 07 Oct 2025 00:00:00 GMTSecurity researcheducationethereumfuzz-testingsecuritysmart-contractsoliditywakeNaoki Yoshidahttps://ack3.ai/research/a-beginners-guide-to-manually-guided-fuzzing/https://ack3.ai/research/a-beginners-guide-to-manually-guided-fuzzing/Learn Manually Guided Fuzzing (MGF) with the Wake framework to find critical smart contract vulnerabilities through systematic testing and defined invariants.Tue, 09 Sep 2025 00:00:00 GMTTechnical guideeducationethereumfuzz-testinghow-tosmart-contracttutorialwakeNaoki Yoshidahttps://ack3.ai/research/uncovering-front-running-vulnerability-with-manually-guided-fuzzing/https://ack3.ai/research/uncovering-front-running-vulnerability-with-manually-guided-fuzzing/Learn how Wake's Manually Guided Fuzzing detects front-running vulnerabilities using differential fuzzing. Includes real examples and best practices.Wed, 03 Sep 2025 00:00:00 GMTSecurity researchauditeducationethereumevmhow-tosmart-contractsoliditytutorialwakeNaoki Yoshidahttps://ack3.ai/research/complete-reentrancy-hands-on-guide/https://ack3.ai/research/complete-reentrancy-hands-on-guide/This guide provides a comprehensive analysis of reentrancy vulnerabilities with examples. Learn how reentrancy works and how to identify it in real protocols.Thu, 21 Aug 2025 00:00:00 GMTTechnical guideeducationethereumexploithackhow-tosmart-contractsoliditytutorialwakeNaoki Yoshidahttps://ack3.ai/research/reentrancy-attack-in-erc-1155/https://ack3.ai/research/reentrancy-attack-in-erc-1155/Learn how attackers can exploit reentrancy vulnerabilities in ERC-1155 implementations to drain vault contracts, with an example real-world attack scenario.Mon, 11 Aug 2025 00:00:00 GMTTechnical guideeducationethereumexploithackreentrancy-attacktutorialwakeNaoki Yoshidahttps://ack3.ai/research/reentrancy-attack-in-erc-721/https://ack3.ai/research/reentrancy-attack-in-erc-721/In this article, we'll examine how attackers can manipulate the _safeMint function's external call to bypass minting limits and drain NFT collections.Mon, 04 Aug 2025 00:00:00 GMTTechnical guideeducationethereumexploithackreentrancy-attacksoliditytutorialwakeNaoki Yoshidahttps://ack3.ai/research/gmx-hack-analysis-attack-scenarios-with-wake/https://ack3.ai/research/gmx-hack-analysis-attack-scenarios-with-wake/This analysis examines the 42M attack on the GMX protocol. We provide details of the vulnerability with a working reproduction of the attack scenario.Tue, 22 Jul 2025 00:00:00 GMTIncident analysiseducationethereumevmexploithacksecuritysmart-contractsoliditytutorialwakeNaoki Yoshidahttps://ack3.ai/research/reentrancy-attack-in-erc-777/https://ack3.ai/research/reentrancy-attack-in-erc-777/In this blog, we describe reentrancy attacks in the ERC-777 standard. ERC-777 is a standard for fungible tokens with a hook for transferring – learn more here.Fri, 25 Apr 2025 00:00:00 GMTTechnical guideeducationethereumexploithackreentrancy-attacksecuritysoliditywakeNaoki Yoshidahttps://ack3.ai/research/flash-loan-reentrancy-attack/https://ack3.ai/research/flash-loan-reentrancy-attack/Flash loans enable borrowing without collateral and repaying within a single transaction. While effective, they also introduce security risks – learn more here.Fri, 11 Apr 2025 00:00:00 GMTTechnical guideeducationethereumexploithackreentrancy-attacksecuritysoliditywakeNaoki Yoshidahttps://ack3.ai/research/cross-chain-reentrancy-attack/https://ack3.ai/research/cross-chain-reentrancy-attack/A cross-chain reentrancy attack is an exploit that targets smart contract function calls. Learn about this vulnerability to keep your code safe from attackers.Mon, 17 Mar 2025 00:00:00 GMTTechnical guideeducationethereumhackreentrancy-attacksecuritywakeNaoki Yoshidahttps://ack3.ai/research/read-only-reentrancy-attack/https://ack3.ai/research/read-only-reentrancy-attack/A read-only reentrancy attack manipulate a smart contracts to extract value. Let's take a closer look at this vulnerability and how to prevent it.Thu, 27 Feb 2025 00:00:00 GMTTechnical guideeducationethereumexploithackreentrancy-attacktutorialwakeNaoki Yoshidahttps://ack3.ai/research/introducing-manually-guided-fuzzing-a-new-approach-in-smart-contract-testing/https://ack3.ai/research/introducing-manually-guided-fuzzing-a-new-approach-in-smart-contract-testing/Learn how manually guided fuzzing combines stateful, white-box testing with flows and invariants to test complex smart contracts more efficiently.Thu, 12 Sep 2024 00:00:00 GMTTechnical guideannouncementsauditeducationethereumfuzz-testingsmart-contractwakeJosef Gattermayerhttps://ack3.ai/research/safe-social-recovery-module/https://ack3.ai/research/safe-social-recovery-module/Safe Smart Accounts are the most audited and battle-tested smart contracts on Ethereum securing over $100 billion in assets. The Safe Social Recovery Module is a…Mon, 19 Aug 2024 00:00:00 GMTAudit summaryauditaudit-summarycandideethereumsafewakeJan Kalivodahttps://ack3.ai/research/cross-contract-reentrancy-attack/https://ack3.ai/research/cross-contract-reentrancy-attack/This research article reviews how cross contract reentrancy attacks work, an attack example, and guidance on how to prevent cross contract reentrancy attacks.…Thu, 11 Jul 2024 00:00:00 GMTTechnical guideeducationethereumexploithackreentrancy-attacktutorialwakeNaoki Yoshidahttps://ack3.ai/research/cross-function-reentrancy-attack/https://ack3.ai/research/cross-function-reentrancy-attack/What is a cross function reentrancy attack? Cross-function reentrancy attacks use multiple functions to execute the attack, which can occur when inappropriate…Thu, 04 Jul 2024 00:00:00 GMTTechnical guideeducationethereumexploithackreentrancy-attacktutorialwakeNaoki Yoshidahttps://ack3.ai/research/single-function-reentrancy-attack/https://ack3.ai/research/single-function-reentrancy-attack/What is a reentrancy attack? A reentrancy attack is very specific to smart contracts due to the nature of external calls. When a contract interacts with another…Thu, 20 Jun 2024 00:00:00 GMTTechnical guideeducationethereumexploithackreentrancy-attacktutorialwakeNaoki Yoshidahttps://ack3.ai/research/wake-erc-4337-detector/https://ack3.ai/research/wake-erc-4337-detector/Ackee is finalizing an ERC-4337 detector to identify the use of forbidden opcodes and storage access, turning a very labor-intensive manual review into an automated…Wed, 15 May 2024 00:00:00 GMTSecurity researchdetectorerc-4337ethereumsafesoliditywakeMichal Převrátilhttps://ack3.ai/research/on-the-wave-of-ci-cd-for-web3/https://ack3.ai/research/on-the-wave-of-ci-cd-for-web3/So you want to write and deploy a smart contract, huh? Let’s set up this environment for a sample project from scratchThu, 07 Dec 2023 00:00:00 GMTTechnical guideeducationethereumhow-tosoliditytutorialwakeJan Kalivodahttps://ack3.ai/research/list-of-ackee-blockchain-public-audits/https://ack3.ai/research/list-of-ackee-blockchain-public-audits/An archived index of Ackee Blockchain public Ethereum, EVM, and Solana audit summaries, covering 41 organizations and 66 linked entries.Sat, 20 May 2023 00:00:00 GMTSecurity researchauditethereumevmsecuritysmart-contractsolanaJosef Gattermayerhttps://ack3.ai/research/how-to-prepare-for-a-smart-contract-audit-2/https://ack3.ai/research/how-to-prepare-for-a-smart-contract-audit-2/How to prepare for a smart contract audit The pre-audit part is essential for a smooth audit, and we will now guide you through it.Fri, 17 Mar 2023 00:00:00 GMTTechnical guideeducationethereumhow-tosoliditywakeJan Kalivodahttps://ack3.ai/research/testing-axelar-contracts-using-open-source-tools/https://ack3.ai/research/testing-axelar-contracts-using-open-source-tools/Building projects on top of cross-chain solutions may lead to security issues in the code. Open-source tools can automatically detect many issues or help test the…Fri, 11 Nov 2022 00:00:00 GMTSecurity researchaxelardeveloper-toolingethereumevmopen-sourcesecuritysmart-contractsolidityvs-codewakeMichal Převrátil