Blockchain Security
Review smart contracts for reentrancy, access control mistakes, oracle manipulation, flash loan attacks, and MEV exposure. Use the security checklist to organize a review.
8 articles
The Quantum Threat to Bitcoin and Ethereum, Measured
The largest elliptic curve key ever broken on real quantum hardware is 15 bits. secp256k1 is 256. Everything else in this argument is a resource estimate on paper, and in 2026 three of them landed inside six months. This article puts demonstrated hardware in one column and projection in the other, and refuses to mix them. You get the current logical-qubit position with dates and vendors, the three 2026 blueprints for breaking secp256k1 side by side with their error-rate and code-family assumptions, and the reason they differ 25x on physical qubits while agreeing almost exactly on logical ones. Then the exposure: Google's own BigQuery count of roughly 6.9 million quantum-vulnerable BTC, the 1.7 million sitting in P2PK outputs since the Satoshi era, and the Taproot regression that put public keys back on chain in the clear after 2009 removed them. Ethereum's exposure is a different shape — 37 million ETH of stake behind BLS and 15 million ETH behind KZG commitments, neither of which any wallet upgrade can fix. Plus what harvest-now-decrypt-later really covers, why Grover does not threaten mining, and the short list of things a team should actually do this year.
Post-Quantum Migration for Blockchain Teams
Most post-quantum migration guides open by quoting NIST's 2030 deprecation and 2035 disallowance dates as settled policy. That document has been an initial public draft since 12 November 2024 and has never been finalised. The thing that actually binds US federal systems and their contractors is Executive Order 14412 of 22 June 2026, with different dates, a different scope, and a FAR rule attached. This guide starts by getting the citation right, then walks the migration in the order the work actually happens: the three FIPS that are final and the two workstreams that are not, why hybrid rather than pure post-quantum is the sane default and what Signal and Cloudflare did about it, where TLS has already moved and the origin-server gap that nobody is closing, the cryptographic inventory step every team skips and the bill-of-materials format that is standardising, and the size consequences that decide whether a scheme fits your protocol at all. Then the part that has no equivalent outside this industry: you cannot hard-fork a signature scheme without moving every single user, which is why BIP-360, BIP-361 and EIP-8141 exist and why none of them contains a post-quantum algorithm yet.
Front-Running and MEV: How to Protect Your Smart Contracts
A security auditor's complete guide to front-running and MEV protection. Covers how MEV bots exploit transaction ordering, sandwich attacks on DEX swaps, and four battle-tested defenses: commit-reveal schemes, Flashbots Protect, slippage guards, and private mempools. Includes production Solidity code, testing strategies, and a look at the evolving MEV landscape in 2026.
Oracle Manipulation Attacks: How Price Feeds Get Exploited
A security auditor's deep dive into oracle manipulation — the most common DeFi exploit vector. Covers how spot price oracles get manipulated through flash loans, real attack case studies (Mango Markets, Cream Finance), and battle-tested defenses: Chainlink price feeds, TWAP oracles, multi-oracle strategies, and circuit breakers. Includes production Solidity code and a complete audit checklist.
Access Control in Smart Contracts: Patterns That Prevent Exploits
A security auditor's guide to smart contract access control — from simple Ownable to role-based AccessControl, multi-sig patterns, timelocks, and emergency pauses. Includes real anonymized audit findings, vulnerable vs fixed code, and Foundry tests that catch access control bugs before attackers do.
Flash Loan Attacks: How They Work and How to Defend Against Them
A deep technical breakdown of flash loan attacks in DeFi — how attackers exploit atomic composability to manipulate prices, drain protocols, and hijack governance. Covers real exploits (Euler Finance, Beanstalk), oracle manipulation vectors, and battle-tested defense patterns with working Solidity code for TWAP oracles, timelocks, and circuit breakers.
Reentrancy Attacks Explained: How They Work and How to Prevent Them
A complete breakdown of reentrancy attacks in smart contracts — from the 2016 DAO hack to modern cross-function and read-only reentrancy variants. Includes working vulnerable code, a full attack contract, defense patterns (Checks-Effects-Interactions and ReentrancyGuard), and Foundry fuzz tests.
Smart Contract Security Checklist: 25 Things to Check Before Mainnet
A comprehensive smart contract security checklist covering 25 critical vulnerabilities to audit before deploying to mainnet — with real vulnerable code examples, Foundry fuzz tests, and fixes. From reentrancy and access control to flash loan attacks and gas optimization.