The Valves Blog
Articles on smart contract security, vulnerability research, and Web3 protocol analysis.
AI-written Solidity is cleaner than ever and AI scanners are free. So why pay for an audit? An honest answer from researchers who use AI every day.
A practical audit-prep checklist for developers and protocol owners, plus a README template you can copy. Get more real bugs found for the same budget.
We benchmarked our Solidity security tool against Ammplify, Sherlock contest #1054. What it caught, the three it didn't fully get, and why more passes didn't help.
Three proven researchers find more of what matters than a thousand unproven ones. What “proven” should mean, and what to ask any audit firm before you sign.
We ran our DAML security tool on two codebases a well-known firm had audited. It found 10 of their 12 issues. What it caught, what it missed and why.
On the EVM, leaking data is not a finding. On Canton, sub-transaction privacy makes disclosure itself part of the attack surface - and information reaching the wrong party is a security finding even if they can never act on it.
On the EVM there is one attacker axis: msg.sender. Canton splits that privilege into two independent ones - actAs and readAs - and auditing them separately is the whole game.
How abi.encodePacked, missing context fields, and incomplete EIP-712
implementations create hash collisions that break authorization systems - before
the cryptography even gets involved.
How inserting a parent contract with state variables silently shifts every storage slot in an upgradeable proxy - and why the EVM executes the corruption without a single revert.
Everybody is so concerned about the current state of audit contests. A clear-eyed look at why the format remains one of the most powerful security tools in Web3 - and what bear markets actually do to it.