Oak Security

Book. Secure. Relax.
Oak Security offers audits, penetration testing, training, and advisory.

[International Cyber Digest @IntCyberDigest]

‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws.

In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.

[CypherTalkMedia @cyphertalkmedia]

🎙️ New CypherTalk: @cadillion and @ourcarback of @quipnetwork join us to talk quantum.

How much of the quantum threat is hype, and how much is real? Find out in this episode as we discuss the reality, threats, and opportunities.

🎧 https://t.co/PD10rpulAt

[Christian Vari @christianvari_]

3 auditors on every line of code, none of them seeing the others' findings until a consensus meeting. That is how Oak Security describes its process, and blinding is what makes the 3 count as 3 and not 1 repeated.

[Oak Security @SecurityOak]

Give upstream advisories a downstream owner. Track patch adoption and test the failure case in your own configuration. A fix in the upstream repository is only the start.

[Oak Security @SecurityOak]

Our Q3 research describes four Cosmos-ecosystem chains exploited through one unsigned-integer underflow in a shared upstream EVM-compatibility module.

[Oak Security @SecurityOak]

Dependency risk also includes ordinary bugs propagating across deployments. Review the version you run, the assumptions you inherit and the local changes you made.

[Oak Security @SecurityOak]

A dependency list tells you what you use. An authority map tells you what it can do.

For every vendor and upstream module: can it move funds, alter a trusted build, or change a security check? Who can revoke that authority?

[Oak Security @SecurityOak]

About half of Q3's $1.07B in losses came from two supply-chain compromises.

Which vendor software can authorise transfers? Which build artefacts do users trust?

Our Q3 update: https://t.co/w7DCdzdXw3

[Oak Security @SecurityOak]

Map every path that can move funds: contract logic, signers, vendor software, release pipelines and dependencies. Give each path a review process and an owner.

[Oak Security @SecurityOak]

14 of the 20 protocols exploited in Q3 had been audited. That is a reason to examine security coverage, not a verdict on audit quality.

[Oak Security @SecurityOak]

A prior audit does not tell you whether the exploited path was in scope, which version was reviewed, or which privileged systems changed afterward.

[Oak Security @SecurityOak]

Our State of Web3 Security report now includes Q3 2026: $1.07B lost across 20 incidents. About half came from two supply-chain compromises.

Read the report and explore the dashboard: https://t.co/lT4oy67573

Incident data: @RektHQ.

[Oak Security @SecurityOak]

@christianvari_ will present our AI auditing methodology at this year's @summit_defi! See you all in Mumbai!

[Defi Security Summit @summit_defi]

@christianvari_ is speaking at DSS 2026.

“Don’t Trust the First Model: A Methodology for Adversarial AI Audits”

Explore the talk and add it to My agenda:
https://t.co/9wIXAwV5Kz

Tickets: https://t.co/RTbPxGH7zF

[Bermuda @bermudabayzk]

Alex @0xhalloc and Jan @JphFritsche currently in Singapore for @token2049!

Come to our booth at the Nexus Startup Area to talk about the future of private payments.

[Oak Security @SecurityOak]

New episode of @cyphertalkmedia.

In the future, will web3 wallets be the new cookies? Kyle says yes

[CypherTalkMedia @cyphertalkmedia]

🎙️ New episode: Kyle Den Hartog (@PryvitKyle), security engineer on the wallet at @brave .

- Why your wallet address is the new tracking cookie
- The browser as an attack surface
- The limits of ZK proofs.

🎧 https://t.co/lpyb1lN9Ys

[Oak Security @SecurityOak]

We have just published our audit report of
ZIGChain v5 for @ZIGFinance. Read all about our findings and recommendations in the report:
https://t.co/KHIzlCdL4T

[Oak Security @SecurityOak]

Building on @arbitrum? The Arbitrum Security Program is open for applications, with audit subsidies for eligible projects.

Oak Security is an approved auditor. Name Oak in the form’s “Preferred auditor” field.

Apply: https://t.co/rV93fTe243

[Christian Vari @christianvari_]

~1,783 wstETH, about $6M, drained from a vault on Base today. The attacker got a malicious contract added to the vault's whitelist, then used it to borrow aBaswstETH debt tokens and pull the underlying wstETH out.

[Oak Security @SecurityOak]

We have just published our audit report of
@quipnetwork 's smart contracts and Ethereum SDK. Read all about our findings and recommendations in the report:
https://t.co/6mdZOIvHYg

[Oak Security @SecurityOak]

We have just published our audit report of
@Valdora_finance 's @CosmWasm StZIG smart contract updates for the ZIGChain v5 migration. Read all about our findings and recommendations in the report:
https://t.co/0ivsLjjGpN