2025

A source-level and on-chain reconstruction of one of the first EIP-7702 exploits: a delegated EOA that defeats the classic flashloan guard, manipulates a PancakeSwap spot price, and inflates a staking position on BSC.

A source-level and on-chain reconstruction of the GMX V1 GLP exploit: the keeper-mediated reentrancy door, the desynced global-short accounting between Vault and ShortsTracker, and the transaction that minted GLP cheap and redeemed it inflated.

A source-level reconstruction of the Cork Protocol exploit: near-expiry HIYA manipulation, unauthenticated CorkHook.beforeSwap calls, fake market setup, and derivative redemption into wstETH.

A source-level reconstruction of the Cetus Sui CLMM exploit: a flawed u256 left-shift overflow check, undercharged add-liquidity math, and the remove-liquidity path that pulled real reserves out.

A reconstruction of the ZKsync airdrop incident: a compromised admin account, sweepUnclaimed-driven minting of 111M ZK, exchange liquidation pressure, and negotiated fund recovery.

A source-level reconstruction of the KiloEx multi-chain exploit: a MinimalForwarder trust-boundary failure, forged keeper calls, direct setPrices control, and leveraged oracle profit extraction.

A source-level and control-plane reconstruction of the UPCX exploit: a compromised privileged key, malicious ProxyAdmin upgrade, withdrawByAdmin execution, and treasury-scale token drain.

A source-level and on-chain reconstruction of the Bybit cold-wallet heist: the tampered Safe{Wallet} JavaScript, the delegatecall storage overwrite, and the full transaction trail.