hexens

Security for systems where risk tolerance is none - fintech, AI, cryptography, blockchains, and beyond.

[hexens @hexens]

1/
we found a bug in the Aptos Move VM that put up to $70B at systemic risk. type confusion at the execution layer. a ~90% success rate across hundreds of simulated runs on a 30+ validator cluster. cost to build the attack infrastructure: $3,000.

Conducted by @kemmio , to our knowledge this is the first public research that showcases how to land a sophisticated multi-block attack in real-world environments. It includes mempool feng shui, block production specifics and about a dozen of other primitives and tricks chained to get to near-perfect exploitation results.

Nonetheless, Aptos called it "extremely low exploitability."

[https://t.co/vjeLaENYn0]

[hexens @hexens]

Paste your contract and see the number:
https://t.co/Z0YphwufrV

[hexens @hexens]

How many addresses does your contract actually depend on?

You can now check it on our site. Paste any contract address and see the number.

We checked this across all teams on Glider Monitor.72% have more addresses in their dependency graph than contracts they deployed.

For about one in four, it’s 10 or more addresses for every contract they wrote.

One team has a single contract and 219 addresses behind it.

Another has 7 contracts and 875.

Another has 16 and 1,288.

Those addresses are price feeds, stablecoins, staking tokens, pools and lending markets.

Any of them can change without the team shipping a single line of code.

[Glider @glider_xyz]

As of Oct 23, in 8 of the 20 largest markets listed on Morpho Ethereum, a single address owes more than half the debt.

In one market with $36M borrowed, one address owes 96%. It’s a vault that pools many depositors’ money, but one decision moves all of it. Lenders there earn 4.6% a year. If that vault repays in full, their rate immediately drops to 0.04%.

In the largest market, $309M borrowed, one address owes 56%. Its full repayment would immediately take lenders from 4.5% to 1.1%.

If you lend directly into one of these markets, your yield is set by whoever borrows the most.

Glider Monitor watches that position every block and alerts you the moment it moves.

[MINT @PlayOnMint]

🛡️ Security is a priority we take seriously at MINT.

We’re proud to share that $MNTD has undergone a security audit by Hexens as part of our commitment to building a robust ecosystem 🤝

[hexens @hexens]

https://t.co/xEUJDyctCD

[hexens @hexens]

Audit Completed: @PlayOnMint

MNTD is the reward and utility token of the Mint ecosystem on Base, earned in-app and usable across its applications.

We covered the fixed token issuance and launch distribution flows, plus two independent staking products built for different user groups.

Wishing the team the best as they keep building.

Full report below:

[kemmio @kemmio]

a great way to hedge for a protocol:
bet that you WILL be hacked

but also @DefiLlama @Trueo_ users are only going to trade when they feel more confident about the decision, and they need metrics, data, etc.

we are ready to provide real-time data on the risk surface for each of protocol entry (dependency graph, recursively analyzed risks, audits, lots of other metrics)

For free.

[hexens @hexens]

Set up your monitoring in minutes:
https://t.co/Z0YphwtHCn

[hexens @hexens]

Two MetaMorpho vaults had $3M in one Morpho market last October.

On October 28 borrowing jumped from $10M to $23M in under a day.

A Glider Monitor rule on borrow spikes would have fired at 17:45 UTC that day. That’s 55 hours before the cash ran out.

By the next morning the market held $2.6M to $3M in cash, and kept it for 43 hours.

Enough to take almost everything out.
One depositor got out. On October 30 they pulled $180,000.

On October 31 at 00:38 UTC a single block took the cash from $2.59M to $99.
The rest is still sitting there.

On paper, unpaid interest has grown it to $932M.

Right now $0 of it can be withdrawn.
The larger vault’s own totalAssets() kept rising the entire time.

Looking only at the vault, nothing looked wrong.

[hexens @hexens]

https://t.co/RoeeKEO00m

[hexens @hexens]

Audit Completed: @UFarmDigital

Tokenized RWA strategies are going live on https://t.co/wBaAWMEuCJ, built on the ERC-3643 permissioned token standard with on-chain investor eligibility and transfer restrictions.

We reviewed the RWA infrastructure behind it: the ERC-3643 token suite, the identity and compliance modules, the factory that deploys a token suite per asset, the private credit token with its investment and withdrawal settlement flows, and the fixed-price sale contract.

Wishing the team the best as they keep building.

Full report below:

[hexens @hexens]

@0xPolygon @tazapay @meshpay @usetoku Congrats!

[hexens @hexens]

Set your own line on your positions:
https://t.co/Z0YphwufrV

[hexens @hexens]

An Aave position lost nearly half its collateral on September 15.

It didn't happen in one move. It took eight small borrows over three weeks.

From late August the owner kept borrowing against wstETH: $300, $250, $100, $100, $250, $150, $20, $50.

After each one the cushion got thinner. Its health factor dipped under 1.05 a dozen times along the way.

The last $50 took it from 1.064 to 1.040. 19 hours later wstETH was down ~4%, and a liquidator took ~$1,270 of collateral.

Without that last $50 it would have survived the block, but only for about 5 hours.

No single borrow killed this position. Together they left it nothing to absorb a normal 4% move.

Glider Monitor tracks the health factor every block, so the slide is visible from the first time it crosses your line, weeks before the liquidation.

[TMRW @tmrwcredit]

Audit complete ✅

Thanks to the @hexens team for a thorough review of our contracts.

Next: Launch 🚀

[hexens @hexens]

https://t.co/3PYPI80YNx

[hexens @hexens]

Audit Completed: @tmrwcredit

TMRW is a yield-bearing digital asset powered by the earnings of the creator economy.

We covered the vault deposit and withdrawal queue, the fee controller and high-water mark logic, oracle price normalization, and the borrower funding and repayment flows.

Wishing the team the best as they keep building.

Full report below:

[SquadSwap 🐰💱 @Squad_Swap]

Security check: done 🛡️🐰

SquadSwap Thanos (V4) + ALM has been audited by @hexens

Core systems reviewed. Findings addressed and verified.

We keep building 💚

Full report 👇

[hexens @hexens]

Monitor what you depend on in under a minute:
https://t.co/Z0YphwtHCn

[hexens @hexens]

Two teams. One has 6 contracts. The other runs 308 across 15 chains.

Which one depends on more code it didn't write, per contract?

The small one. By more than ten times.

6 contracts sit on 266 dependency addresses. 308 sit on 1,002. Over 40 per contract against fewer than 4.

Both teams run on Glider Monitor, which is how we know. Contract count is the wrong number to worry about.