The Valves Blog
Articles on smart contract security, vulnerability research, and Web3 protocol analysis.
We ran our Valves security tool against two public Canton/DAML audits from a well-known firm. It recovered 10 of the 12 validated issues - with the two misses correctly downgraded to informational - and surfaced 50+ more.
On the EVM, leaking data is not a finding. On Canton, sub-transaction privacy makes disclosure itself part of the attack surface - and information reaching the wrong party is a security finding even if they can never act on it.
On the EVM there is one attacker axis: msg.sender. Canton splits that privilege into two independent ones - actAs and readAs - and auditing them separately is the whole game.
How abi.encodePacked, missing context fields, and incomplete EIP-712
implementations create hash collisions that break authorization systems - before
the cryptography even gets involved.
How inserting a parent contract with state variables silently shifts every storage slot in an upgradeable proxy - and why the EVM executes the corruption without a single revert.
Everybody is so concerned about the current state of audit contests. A clear-eyed look at why the format remains one of the most powerful security tools in Web3 - and what bear markets actually do to it.