Knowledge-Base

SlowMist Security Research A collection of security research by the SlowMist Team. Smart Contract Security Research Blockchain Security Research Exchange Security Research Wallet Security Research...

owasp-scs

OWASP Smart Contract Security SCS Join the OWASP Smart Contract Security Slack Discussions and Support This is the official GitHub Repository of the OWASP Smart Contract Security SCS project. This comprehensive initiative provides security standards, guidance, and resources for smart contract...

awesome-web3-security — Updated!

awesome-web3-security A curated list of Web3 Security materials and resources for Pentesters and Bug Hunters. If you find that some links are not working, you can simply replace the username with gmh5225. Or you can send an issue for me. Show respect to all the projects below, perfect works of ar...

CredShields Joins Forces with Checkmarx to Bring Smart Contract Security to Enterprise AppSec Programs

Singapore, Singapore, 19th November 2025, CyberNewsWire...

EUVD-2018-5137

Malware in sbrugna...

EUVD-2018-5427

Malware in sbrugna...

EUVD-2018-5479

Malware in sbrugna...

EUVD-2018-5503

Malware in sbrugna...

EUVD-2018-5075

Malware in sbrugna...

EUVD-2018-5413

Malware in sbrugna...

EUVD-2018-5480

Malware in sbrugna...

EUVD-2018-5620

Malware in sbrugna...

EUVD-2023-1359

Malicious code in bioql PyPI...

EUVD-2022-6503

Malicious code in bioql PyPI...

EUVD-2025-21789

Malicious code in bioql PyPI...

Exploit for CVE-2025-4126

POC-CVE-2025-4126 smart contract reentrancy attack vulnerabili...

CVE-2025-54070

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the lastIndexOfbytes,byte,uint256 function of the Bytes.sol library may access uninitialized memory when the following two conditions hold: 1 the provided buffer length...

Missing validation to ensure that the _l2CoreGovTimelock parameter is not the zero address in the initialize function

Lines of code Vulnerability details Impact The initialize function accepts a parameter l2CoreGovTimelock and does check if it's a contract address using Address.isContract. However, there's no explicit check to ensure that l2CoreGovTimelock is not the zero address...

Upgraded Q -> 2 from #7 [1677668529704]

Judge has assessed an item in Issue 7 as 2 risk. The relevant finding follows: L-01 changePayees Suggest adding to check whether newPayees are duplicated to avoid totalShares error function changePayeesaddress calldata newPayees, uint256 calldata newShares external override onlyManager ... for...

Unpacking the "0x1626ba7e" Mystery: The Risks of Unidentified Fixed Values in Smart Contracts - loss of funds

Lines of code Vulnerability details Impact The use of a fixed value in the require statement without understanding its significance creates a security vulnerability in the contract. An attacker could manipulate the returned value to bypass the require statement and execute malicious code. This ca...