Slayer Security

We slay Bugs

Smart contract Security

Checkout our work

[Slayer Security @slayersecurity]

@ddimitrovv22 No better time to get audited and secure yourself.

[Slayer Security @slayersecurity]

We will be sharing very exciting news soon...

[Slayer Security @slayersecurity]

@__Raiders I do it often haha. Today is that day

[Slayer Security @slayersecurity]

This time monero.

[chrisdior @chrisdior777]

🚨 JUST IN:

@RetoSwap, the largest Monero DEX, was drained for ($2.7M).

RetoSwap runs on @HavenoDEX , the P2P Monero trading protocol where the bug was found.

Root cause: Haveno flaw allowing pre-multisig arbitrator spoofing via fake ACK messages.

Trading is halted.

[Slayer Security @slayersecurity]

The Aurellion Labs bug is a good reminder that proxy safety is not just "is there an owner?" The contract can have an owner and still be uninitialized. For Diamond/proxy systems, post-deploy checks should assert the initializer is consumed.
https://t.co/eomtyUk6pM

[Slayer Security @slayersecurity]

We are about to finalize the audit for @ammomarkets , and uncovered some interesting edge cases around staking contracts and mint flow.

The report will be public soon...

If you are a protocol with a tight budget and need a quality audit before launch, DM Us.

[Slayer Security @slayersecurity]

An exploit on the Echo Protocol led to a loss of approximately $76.7 million.

Cause: stolen administrator private key (an operational failure) rather than a flaw in the smart contract code.

https://t.co/yefhqHbaXb

[Coin Bureau @coinbureau]

⚠️ALERT: ANOTHER MAJOR HACK STRIKES CRYPTO; $76M EXPLOIT HITS MONAD

Echo Protocol on Monad was reportedly exploited after an attacker minted 1,000 eBTC worth roughly $76.6M, as per Lookonchain.

The hacker allegedly used part of the funds as collateral on Curvance to borrow WBTC, bridged assets to Ethereum, swapped them into ETH, and routed roughly 385 ETH through Tornado Cash.

The attacker still reportedly controls around 955 eBTC worth over $73M.

This now marks the THIRD major crypto exploit in just 4 days!

[Slayer Security @slayersecurity]

Hacks never stop.

[0xApple @0xapple_]

🚨 $11.58M drained from @VerusCoin
’s Ethereum bridge in minutes.

The attacker made one tiny real transaction on Verus — ~$10 in fees. Just enough to get a real `txid` on-chain. Nothing valuable. Just a receipt.

He took that receipt + Verus chain data and crafted a PartialTransactionProof.

Then he submitted it to the Ethereum bridge contract via submitImports() → proveImports()

The bridge checked two things:
✅ Does the proof's state root match Verus?
✅ Does the hash match?

What the bridge *never* checked:

❌ "Is this txid actually backed by $11.58M locked on Verus?"

That one missing check cost the protocol:
→ 1,625 ETH
→ 103 tBTC
→ 147,000 USDC

The proof was real. The money behind it wasn't.

[Slayer Security @slayersecurity]

Building in Web3 and looking for a security partner without putting a scratch on your runway?

DM us at @slayersecurity or visit https://t.co/a4H62Yepys

We will put everything we know to secure your code, so you can sleep at peace.

[Slayer Security @slayersecurity]

Excited to announce our audit partnership with @AmmoMarkets 🤝

[Slayer Security @slayersecurity]

At Slayer Security, our goal is simple:

High quality audits that teams can actually afford.

"We Slay Bugs, Not Your Budget."

[Slayer Security @slayersecurity]

We are grateful for all your contributions to smart contract security. Thank You C4

[Code4rena @code4rena]

After careful consideration, we’ve made the decision to wind down @code4rena. This community has meant a great deal to everyone who has been part of building it, and sharing this news is not easy.

[Orion Finance @OrionFinanceAI]

Bug Bounty Week 3 📌

This week, we've processed 14 new submissions.

The updated scoreboard:
- Total Reports: 75
- New Findings: +4 Lows identified and mitigated.

Every submission helps us harden our architecture as we approach our final audit.

[Slayer Security @slayersecurity]

Each issue alone may have seemed low severity.

Combined, they formed a complete exploit chain:
become trusted → replay signatures → drain funds.

This is why smart contract audits must analyze system composition and interaction boundaries, not just isolated functions.

[Slayer Security @slayersecurity]

TrustedVolumes lost ~$6.7M from 3 compounding vulnerabilities in their RFQ swap proxy. 🧵

The exploit wasn’t caused by one critical bug. It came from multiple smaller issues interacting with each other.
https://t.co/Fy4RCZRxc3

[Slayer Security @slayersecurity]

3. Unvalidated transfer source field

The contract trusted user-controlled source addresses during transfers, enabling unauthorized movement of approved funds.