Security for those who cannot afford a mistake.

Pinned Tweet
1/ we found a bug in the Aptos Move VM that put up to $70B at systemic risk. type confusion at the execution layer. a ~90% success rate across hundreds of simulated runs on a 30+ validator cluster. cost to build the attack infrastructure: $3,000. Conducted by @kemmio , to our knowledge this is the first public research that showcases how to land a sophisticated multi-block attack in real-world environments. It includes mempool feng shui, block production specifics and about a dozen of other primitives and tricks chained to get to near-perfect exploitation results. Nonetheless, Aptos called it "extremely low exploitability." [hexens.io/research/aptos-hij…]
11
47
326
85,652
Two MetaMorpho vaults had $3M in one Morpho market last October. On October 28 borrowing jumped from $10M to $23M in under a day. A Glider Monitor rule on borrow spikes would have fired at 17:45 UTC that day. That’s 55 hours before the cash ran out. By the next morning the market held $2.6M to $3M in cash, and kept it for 43 hours. Enough to take almost everything out. One depositor got out. On October 30 they pulled $180,000. On October 31 at 00:38 UTC a single block took the cash from $2.59M to $99. The rest is still sitting there. On paper, unpaid interest has grown it to $932M. Right now $0 of it can be withdrawn. The larger vault’s own totalAssets() kept rising the entire time. Looking only at the vault, nothing looked wrong.
1
7
19
1,262
Audit Completed: @UFarmDigital Tokenized RWA strategies are going live on UFarm.Digital, built on the ERC-3643 permissioned token standard with on-chain investor eligibility and transfer restrictions. We reviewed the RWA infrastructure behind it: the ERC-3643 token suite, the identity and compliance modules, the factory that deploys a token suite per asset, the private credit token with its investment and withdrawal settlement flows, and the fixed-price sale contract. Wishing the team the best as they keep building. Full report below:
1
5
12
756
An Aave position lost nearly half its collateral on September 15. It didn't happen in one move. It took eight small borrows over three weeks. From late August the owner kept borrowing against wstETH: $300, $250, $100, $100, $250, $150, $20, $50. After each one the cushion got thinner. Its health factor dipped under 1.05 a dozen times along the way. The last $50 took it from 1.064 to 1.040. 19 hours later wstETH was down ~4%, and a liquidator took ~$1,270 of collateral. Without that last $50 it would have survived the block, but only for about 5 hours. No single borrow killed this position. Together they left it nothing to absorb a normal 4% move. Glider Monitor tracks the health factor every block, so the slide is visible from the first time it crosses your line, weeks before the liquidation.
3
6
21
1,583
hexens retweeted
Audit complete ✅ Thanks to the @hexens team for a thorough review of our contracts. Next: Launch 🚀
Audit Completed: @tmrwcredit TMRW is a yield-bearing digital asset powered by the earnings of the creator economy. We covered the vault deposit and withdrawal queue, the fee controller and high-water mark logic, oracle price normalization, and the borrower funding and repayment flows. Wishing the team the best as they keep building. Full report below:
2
4
12
771
Audit Completed: @tmrwcredit TMRW is a yield-bearing digital asset powered by the earnings of the creator economy. We covered the vault deposit and withdrawal queue, the fee controller and high-water mark logic, oracle price normalization, and the borrower funding and repayment flows. Wishing the team the best as they keep building. Full report below:
2
5
17
1,697
Security check: done 🛡️🐰 SquadSwap Thanos (V4) + ALM has been audited by @hexens Core systems reviewed. Findings addressed and verified. We keep building 💚 Full report 👇
1
7
8
318
Two teams. One has 6 contracts. The other runs 308 across 15 chains. Which one depends on more code it didn't write, per contract? The small one. By more than ten times. 6 contracts sit on 266 dependency addresses. 308 sit on 1,002. Over 40 per contract against fewer than 4. Both teams run on Glider Monitor, which is how we know. Contract count is the wrong number to worry about.
1
4
17
1,675
We allocated Hexens treasury capital into CARRY. Leveraged RWA exposure paired with delta-neutral strategies only works if the risk is structured, not just passed through. CARRY launches with continuous monitoring in place. That's why we're in. Congrats @Vault_St on the launch.
Introducing CARRY: 12%+ target yield from leveraged RWAs by @MidasRWA @Figure @SuperstateInc @Bitwise
1
8
21
1,410
A MetaMorpho vault's timelock is your exit window. When a curator makes a risky change, the change has to wait, and that wait is your time to pull your money out. On one Ethereum vault, the window reads 3 days. It's effectively 1. Last November, a change cutting it to 1 day was queued. It cleared its own waiting period three days later and has been sitting there, ready, for 324 days. Here's what that means. One transaction applies it. The next risky change only has to wait 24 hours. If you're asleep, on a flight, or just not checking that day, your window has already closed. And the vault still says 3 days. Glider Monitor reads the pending value, not just the one on display.
1
6
14
1,013
If you want to know about your risks and control them Come see us at Token2049 main event floor1
5
17
762
Audit Completed: @LEDiG_Tech Ledig is a fully collateralised on-chain call options protocol, letting institutions lock a fixed rate between stablecoins ahead of expiry for emerging market FX. We covered the option lifecycle from purchase to exercise, writer reservation and settlement, strike price representation, and fee routing. Wishing the team the best as they keep building. Full report below:
2
4
14
1,352
hexens retweeted
Also this week: 🔓 @hexens Wasmer sandbox escape to RCE ⚡ Core Lightning warns of node attacks 🎣 LinkedIn job scams and Gmail-to-fake-support social engineering 🍎 A new MacSync stealer hunting crypto devs 💸 A Robinhood Chain rug factory moving $9M+ in 30 days
1
2
2
197
Audit Completed: @Squad_Swap SquadSwap Thanos (V4) is a PancakeSwap Infinity fork that adds an Automated Liquidity Manager on top of the core AMM. We covered the core protocol across swap routing, hooks, fee logic and migration flows, plus the ALM strategy contracts. Wishing the team the best as they keep building. Full reports below:
1
6
16
1,360