Skip to content
DeFi security · research & analysis

Know Your Protocol

Incident write-ups, security research, and short essays on DeFi — backed by a structured database of protocol permissions, trust surfaces, and audit findings.

Read the notes Browse the database

Latest notes

Security research, incident write-ups, and short essays.

All 6 notes →
Incident protocol-wide · 1,656,942.281791 nominal stablecoin units · ongoing · 8 min read

Allbridge Core Solana drain: same-pool account aliasing inflated vUSD state

A forensic analysis of the July 2026 Allbridge Core Solana drain: duplicate source and destination pool accounts were accepted by swap, repeated same-token calls compounded internal vUSD state, and approximately 1.657 million nominal stablecoin units left the USDC and USDT vaults.

solanabridgestablecoinflash-loanpost-mortem ↳ Allbridge Core
updated Incident

Hinkal shielded-pool drain: phantom notes from an unsound ZK proof
Incident

Inflating a meta-vault's NAV with a share donation: the Summer.fi FleetCommander drain
updated Incident

Inflating liquidityIndex with flashloan premiums: a ZeroLend post-mortem

Protocol database

Permission analysis & audit findings — 5 protocols across 3 chains · 1 failing gate.

Browse & filter all →

Saturn Credit

Gate: Conditional
Ethereum 10 contracts 3 audits
Medium
Score 68.4 · Grade B
3 EOA surfaces

MUSD Savings Strategy (sMUSD)

Gate: Conditional
Mezo 10 contracts 2 audits
Medium
Score 72 · Grade B

MUSD (Mezo USD)

Gate: Conditional
Mezo 18 contracts 1 audit
Medium
Score 60 · Grade B

Altura Trade

Gate: Fail
HyperEVM 2 contracts 3 audits
Critical
Score 0 · Grade F
2 deal-breaker FAILs 6 EOA surfaces

APYX

Gate: Pass
Ethereum 12 contracts 3 audits
Medium
Score 72 · Grade B