1/ 🚨 BREAKING: HYDN rescued over $600k of user funds during an attack on @SushiSwap. Our team was the first to identify a critical vulnerability and worked quickly with SushiSwap to rescue user funds. Here's the inside scoop on how it all went down.👇 #blockchain #sushi

L2 downtime is not a free pause for your protocol. If the sequencer is dark and your oracle still serves the last good price with no grace window, the first blocks after recovery liquidate and mint against a market that moved offline. Pair sequencer uptime with staleness. Treat either alone as incomplete.

onlyOwner on pause looks clean in the report. If that owner is one hot EOA on the same laptop as Discord and deploys, a phish skips the contracts entirely. Pause becomes their kill switch, or yours goes missing when you need it. Cold multisig for privileged roles. Dry-run the path before mainnet.

Pen tests die when the build keeps moving. If main gets merges after kickoff and nobody re-baselines the scope, you're testing a ghost. Findings map to commits that no longer ship. Freeze a hash, write it in the SOW, and treat every later change as a delta that needs its own pass.

The smartest drain this year still starts with a job offer. Fake recruiter, real-looking company page, "review this branch before the call." Setup script or poisoned dependency on the lead laptop. Deployer key walks out before any auditor opens the contracts. Unsolicited code review is hostile input until you prove who sent it.

When a wallet empties overnight, start with the allowances. A lot of "contract hacks" were just an infinite ERC-20 approve to a lookalike spender. The bytecode was fine. The signature was not. Check allowance(owner, spender) before you rewrite the postmortem.

If your agent can call a tool, treat every tool response as untrusted input. A "successful" API call can still carry instructions. Scraped docs, ticket text, a support reply. The model will follow them if you give it the keys. Separate read access from write/sign. Don't let the same session do both.

Auditing source without the init calldata is half a job. Wrong owner, wrong oracle, wrong fee recipient on the first call can brick or drain before any later upgrade lands. Freeze the deploy script and the initializer args with the commit hash.

A clean audit does not stop a cloned frontend. Users sign what the page asks for. Lookalike domain, poisoned bookmark, support DM with a connect link. Bytecode never gets a vote on that path. Pin the real URL. Treat every new tab like an untrusted host.

Your audit covered the commit in the SOW. Production may be running whatever the deploy pipeline last signed. If CI can push different bytecode than the freeze tag, the report describes code users never got. Treat the release artifact hash like the commit hash you froze.

A successful oracle call is not the same as a live price. If the round is incomplete or the updatedAt is hours old, your protocol still got a number. It just may not be the market. Check heartbeat and staleness on-chain the same way you check decimals.

A sealed hardware wallet is still a supply-chain problem until you verify the device, not the box. If recovery words leave over radio before you ever type them, the seed was never yours. Buy path, reseller chain, and first-power checks matter as much as firmware. Audit the kit the same way you audit a deploy key.

Third-party Safe modules keep showing up as the real attack surface. Core Safe holds. The custom module that lets any caller set target and calldata does not. Threshold on the wallet means nothing if an attached module skips it.

Your protocol can be fully audited and still lose funds through the admin path. If one EOA can upgrade the implementation, pause markets, or set the oracle address with no delay anyone can actually react to, the audit covered the logic. It did not cover who holds the kill switch.

Your LLM agent with wallet or tool access is an untrusted operator of those tools. Prompt injection stops being a content-filter problem the moment the agent can sign, transfer, or hit privileged APIs. Every doc, email, and page it reads is hostile input until the tool boundary actually holds.

Audit scope freeze is not bureaucracy. It is the only way the report matches the code that ships. If new contracts keep landing after kickoff, the findings map to a codebase that no longer exists. Freeze the commit hash in the SOW, or you are buying a snapshot of a moving target.

Fake recruiter DMs still work because the first ask looks harmless. A coding test in a shared repo, a “quick screen share,” or a Mac .dmg “interview tool.” The payload is not in the job description. It is in whatever you run before you verify who owns the domain and the GitHub org. Treat unsolicited hiring outreach like unsolicited wallet connects.

A lot of 3-of-5 multisigs are still one failure domain. Three keys in the same password manager, same laptop backup, or same cloud account does not give you three independent signers. It gives you one compromise path with extra ceremony. Threshold only works when the keys do not share recovery, devices, or people who can unlock each other.

A smart contract audit and a pen test answer different questions. The audit asks whether the bytecode holds up under adversarial input. The pen test asks whether someone can reach the keys, admin paths, deploy pipeline, or the frontend that talks to it. Fund only one and the other half of the stack stays untested.

Valid signed authorizations drained a multi-million vault this week. No broken Solidity required. If users can pre-sign spending permissions that stay live, a later phishing page only needs that signature, not the private key. Expiry, amount caps, and allowance inventories matter as much as the contract logic.

Another multi-chain hot wallet drain, cause listed as suspected private-key compromise. A contract audit does not cover the laptop that signs withdrawals. If that key lives on a box that also runs Discord, browser extensions, and random npm installs, the path is already open. Segregate signing. Treat the operator machine as hostile.