6 posts tagged with "Solidity"

TL;DR​

Abracadabra, the multi-chain lending protocol behind the MIM stablecoin, was exploited in early October 2025 for about 1.7 to 1.8 million dollars. The attacker abused a logic bug in Cauldron V4's cook() batch flow that let the final solvency check be skipped.

Introduction: Why This Matters​

In July 2025, a single overlooked detail in GMX's smart contracts drained $42 million in a matter of hours. Countless audits and trusted tools failed to see it coming. For developers and decision makers alike, the most unsettling part was this: the vulnerability was not obvious, yet it was enough to shake one of the largest DeFi protocols.

In the world of Web3, security is everything. Yet, time and again, we see major projects fall victim to exploits that, in hindsight, seem devastatingly simple. The recent hack of the NFT platform SuperRare is a textbook example. A vulnerability in their RareStaking contract allowed an attacker to drain approximately $730,000 in RARE tokens.

What is Yield Farming?​

Yield farming (a.k.a. liquidity mining) is a DeFi strategy in which users lock assets in protocols—lending pools, AMMs, automated vaults—to earn rewards such as interest, fees, or governance tokens. Farmers constantly shift capital in search of the best returns, so smart-contract reliability is critical. Manual reviews are slow, and many legacy static-analysis tools drown teams in false positives.

What are NFTs?​

Non-Fungible Tokens (NFTs) are unique digital tokens recorded on-chain that act as tamper-proof certificates of ownership for a specific item— typically artwork, media files, game assets, or membership passes.

Unlike fungible cryptocurrencies, every NFT carries a one-of-a-kind ID tied to its contract address, so it cannot be swapped 1-for-1 with another token.
This baked-in uniqueness allows:

• verifiable ownership & provenance,
• programmable features such as royalties or gated access, and
• instant portability across wallets, marketplaces, and apps.

As NFT platforms execute hundreds of thousands of on-chain actions per day, smart-contract reliability is critical. Manual reviews are slow and error-prone, and legacy static-analysis tools generate too many false positives.

Bug Hunter is an automated Solidity code reviewer that delivers precise, low-noise insights early in development, with < 5 % false-positive rate. The following sections explore its performance on a range of NFT protocols and the key vulnerabilities it detects.