Intent Solvers: The Execution Path You Never Sign
Users sign constraints, not calldata. A field note on solver selection, partial fills, simulation gaps, and the execution boundary that moved off the wallet preview.
Intel Brief
Cybersecurity research, breach analysis and practical defence.
{{ featured.tag }}
{{ featured.title }}
{{ featured.excerpt }}
{{ featured.author }}
// Intel Brief
From both sides of the line.
Teardowns · threat research · practical defense
Cross-chain message verification beyond the bridge contract
Where proof checks end and trust assumptions begin on the receiving chain — a field guide to what bridge audits miss once the message leaves the contract.
Where VASP testing falls short of the VARA Rulebook
A practical reading of Dubai's Technology & Information Rulebook on annual testing, cryptographic keys, and the live systems that still decide outcomes.
Signer ops beat signature schemes
In 2026 the expensive failures still land on humans approving the wrong thing. Here is how we scope signer operations the way we scope contracts.
Upgradeability is where protocols quietly die
Immutable code is rare. Upgrade paths are common—and under-reviewed. A 2026 field guide to where proxy, governor, and timelock designs actually fail.
Reentrancy in 2026: the bugs that refuse to die
Read-only, cross-function, and callback-chain reentrancy still slip past scanners. A field note on what the call graph actually looks like in production DeFi.
Anatomy of the Bybit hack: when the UI is the exploit
How a poisoned signing interface helped drain a cold wallet path, and why the same human-layer class still threatens exchanges, treasuries, and enterprise approval flows.
Your IAM is your perimeter now
Cloud breaches keep tracing back to identity. A practical hardening note for AWS, Azure, and GCP when the firewall is no longer the outer wall.
Phishing still wins. Here's the data.
The inbox still beats the firewall. What holds up in phishing simulations and what is theatre when you measure click, report, and dwell.
Auditing consensus: beyond the smart contract
Validator logic, networking, and timing assumptions are where L1 and L2 existential risk still lives. A scope note for teams that only reviewed the Solidity.
SOC 2 without the theater
Controls engineers respect and auditors can evidence, without rebuilding a parallel paperwork company every audit season.
Tokenomics as an attack surface
Supply schedules, vesting, and incentives are executable risk. A field guide to economic exploits that never need a novel Solidity bug.