sherlockvarm

Security Researcher @QuillAudits_AI || Prev - @Kleros_io

[Elon Musk @elonmusk]

@iam_smx *trillioniare

[QuillAudits 🥷 @QuillAudits_AI]

Formal verification is the only security method with no miss rate.

Zcash's Orchard circuit had a silent inflation bug for 4 years. Expert audits missed it.

A formal verifier does not flag suspicious code. It attempts to prove output = [scalar]*base for all inputs. When the constraint is missing, the proof cannot close. That is a fundamentally different guarantee.

The proof closes or it does not.

We broke down the Zcash bug, the attack chain, and exactly how formal verification would have caught it.

Read it here 👇

[QuillAudits 🥷 @QuillAudits_AI]

https://t.co/KReOMJGRi4

[QuillAudits 🥷 @QuillAudits_AI]

🚨 @Humanityprot exploited for $40M+

The attacker didn't find a bug in the code. They compromised 3 Gnosis Safe admin keys, took ownership of the ProxyAdmin, and silently upgraded the entire H token infrastructure across Ethereum and BSC, and managed to get 1,641,182,632 H tokens.

Here's exactly what happened 🧵

[QuillAudits 🥷 @QuillAudits_AI]

🔥 QuillAudits is now officially ISO/IEC 27001:2022 certified.

The gold standard in information security, independently audited, not self-declared.

Your security is verified, not assumed.

Full breakdown of what our ISO certification means for your audit 👇

[QuillAudits 🥷 @QuillAudits_AI]

🥷 QuillAudits is coming to New York

ETHConf NYC and our CEO @raopreetam_ & CPO @bigrkg will be on the ground the entire time.

If you're building in DeFi, stablecoins, or RWAs and want to talk security, this is your shot to sit down with the people who've investigated some of the biggest exploits of 2026.

Find us at the Javits Center across all 3 days.

Whether it's a 10-minute coffee or a deeper conversation, we're there for it 🤝

📅 June 8 – 10 | Javits Center, NYC

[Preetam📍NYC 🇺🇲 @raopreetam_]

$340M+ lost across 14 bridge attacks in 2026 YTD.

The pattern isn't new. Verification bypasses, key compromises, validator failures, and poisoned state mappings continue to drain user funds. Our May threat report shows bridge-related incidents were responsible for the majority of losses this month.

The attack surface is expanding faster than most teams are securing it.

[QuillAudits 🥷 @QuillAudits_AI]

Crypto neobanks are complex financial products in Web3.

They inherit attack surfaces from traditional banking AND crypto infrastructure simultaneously. Most founders audit the smart contract and call it done.

That covers 1 of 11 attack surfaces.

Infini learned this the hard way. $49.5M gone in two transactions. No zero-day. Just an admin key that was never revoked.

The neobank stack is six layers deep. KYC pipeline. Core banking ledger. Card issuing stack. Crypto custody. Mobile layer. On-chain settlement.

A standard audit covers the bottom one.

We mapped all 11 attack surfaces across all six layers. If you are building a card-issuing neobank, read this before your next audit 👇

[Rekt News @RektHQ]

$5.4M gone from @gravity_bridge. An attacker minted worthless tokens on Osmosis, poisoned the token registry with a fabricated denom string, and walked out with real assets. They didn't break the code. They just found where it stopped asking questions.

https://t.co/OPFcsqimxS

[QuillAudits 🥷 @QuillAudits_AI]

https://t.co/VGtsYVp0ft

[QuillAudits 🥷 @QuillAudits_AI]

🚨 @gravity_bridge drained $5.4M.

Here's what happened:

• Attacker minted 4 worthless tokens on Osmosis, one per custody asset (USDC, USDT, WETH, PAXG)

• IBC-transferred them to Gravity chain, then called permissionless deployERC20() on Ethereum with a fabricated cosmosDenom string embedding real token addresses

• Validators attested to the event. Registry wrote fake IBC denoms mapped to real custody contracts

• Attacker withdrew fake balances. Bridge released real tokens.

On-chain evidence shows the denom-to-ERC20 registry was written with real custody token addresses instead of the newly deployed wrapper contracts confirmed via 4 MsgERC20DeployedClaim transactions on Gravity chain. The precise code path that caused this substitution remains subject to official postmortem.

Full breakdown 👇

[QuillAudits 🥷 @QuillAudits_AI]

🚨 New Market Trading lost $3.78M in 15 minutes.

88 Safes drained across Ethereum, Base, and Arbitrum.

No flash loan. No bridge exploit. The attacker read a public contract, copied a delegate address, and called an unguarded function.

The fix was one line:
require(msg.sender == delegate);

Full breakdown below 👇:

[QuillAudits 🥷 @QuillAudits_AI]

🚨 @TesseraDao exploited on BSC, $2.4M drained via private key compromise.

The attacker didn't find a bug in the code. They got the keys and used the protocol's own functions against it.

TSR dropped from $5.50 to $0.000255 in minutes.

🧵 Full breakdown:

[QuillAudits 🥷 @QuillAudits_AI]

https://t.co/YZBFSjLtMU

[sherlockvarm @SherlockVarm]

yeah, got the real issue, gravity denom to erc20 registry gets poisoned via MsgERC20DeployedClaim (deployERC20 calls), validators attested the claim, registry wrote whatever ERC20 address was embedded in the denom string with zero check if it was a real custody token, working on the detailed report, will share soon.

[QuillAudits 🥷 @QuillAudits_AI]

🚨 @gravity_bridge Exploited, $5.4M Drained

Assets drained:
• 4,349,701.31 USDC (~$4.35M)
• 434,072.40 USDT (~$434K)
• 274.34 WETH (~$552K)
• 14.16 PAXG (~$64K)

Attacker wallets: https://t.co/idXMcApUxJ
https://t.co/Na2mj0ymlw

Vulnerable contract: https://t.co/sHySbtNnOW

Attacker Funding tx: https://t.co/gLCDyh1zVT

[QuillAudits 🥷 @QuillAudits_AI]

🧠 Your contract is clean. Your agent isn't.

Prompt injection, memory poisoning, malicious routers, none of this shows up in a bytecode audit.

The executor is now a reasoning model. It reads token names, price labels, and on-chain data. Any of it can be an instruction.

26 LLM routers were found secretly draining wallets. $500K gone. Zero contract bugs.

Memory poisoning plants false beliefs across sessions. Runtime guardrails don't catch it. The exploit already happened.

The attack surface moved from code to interpretation. Most teams haven't noticed yet.

Full breakdown on attack vectors, secure architecture, and what AI-native auditing actually looks like 👇

[Rekt News @RektHQ]

$3.98 million drained from 88 Gnosis Safes across three chains on New Market Trading. A third-party Safe module trusted caller-supplied data over msg.sender. One missing require check. Anyone who read the source code could drain every wallet.

https://t.co/7fHWPH8b6F

[QuillAudits 🥷 @QuillAudits_AI]

https://t.co/gHvmtIGnr5

[QuillAudits 🥷 @QuillAudits_AI]

Most stablecoins don't fail at launch. They fail before the first line of code.

$322B in supply. Tokenized stocks settling on-chain. BlackRock. Franklin Templeton.

The blast radius of a stablecoin failure isn't a DeFi problem anymore.

We broke down exactly what we'd build, day by day, if we were launching one.

Architecture. Threat modeling. Audits. Key security.

The full blueprint 👇