1/ 🚨 BREAKING: HYDN rescued over $600k of user funds during an attack on @SushiSwap. Our team was the first to identify a critical vulnerability and worked quickly with SushiSwap to rescue user funds. Here's the inside scoop on how it all went down.👇 #blockchain #sushi

If your agent can call a tool, treat every tool response as untrusted input. A "successful" API call can still carry instructions. Scraped docs, ticket text, a support reply. The model will follow them if you give it the keys. Separate read access from write/sign. Don't let the same session do both.

Auditing source without the init calldata is half a job. Wrong owner, wrong oracle, wrong fee recipient on the first call can brick or drain before any later upgrade lands. Freeze the deploy script and the initializer args with the commit hash.

A clean audit does not stop a cloned frontend. Users sign what the page asks for. Lookalike domain, poisoned bookmark, support DM with a connect link. Bytecode never gets a vote on that path. Pin the real URL. Treat every new tab like an untrusted host.

Your audit covered the commit in the SOW. Production may be running whatever the deploy pipeline last signed. If CI can push different bytecode than the freeze tag, the report describes code users never got. Treat the release artifact hash like the commit hash you froze.

A successful oracle call is not the same as a live price. If the round is incomplete or the updatedAt is hours old, your protocol still got a number. It just may not be the market. Check heartbeat and staleness on-chain the same way you check decimals.

A sealed hardware wallet is still a supply-chain problem until you verify the device, not the box. If recovery words leave over radio before you ever type them, the seed was never yours. Buy path, reseller chain, and first-power checks matter as much as firmware. Audit the kit the same way you audit a deploy key.

Third-party Safe modules keep showing up as the real attack surface. Core Safe holds. The custom module that lets any caller set target and calldata does not. Threshold on the wallet means nothing if an attached module skips it.

Your protocol can be fully audited and still lose funds through the admin path. If one EOA can upgrade the implementation, pause markets, or set the oracle address with no delay anyone can actually react to, the audit covered the logic. It did not cover who holds the kill switch.

Your LLM agent with wallet or tool access is an untrusted operator of those tools. Prompt injection stops being a content-filter problem the moment the agent can sign, transfer, or hit privileged APIs. Every doc, email, and page it reads is hostile input until the tool boundary actually holds.

Audit scope freeze is not bureaucracy. It is the only way the report matches the code that ships. If new contracts keep landing after kickoff, the findings map to a codebase that no longer exists. Freeze the commit hash in the SOW, or you are buying a snapshot of a moving target.

Fake recruiter DMs still work because the first ask looks harmless. A coding test in a shared repo, a “quick screen share,” or a Mac .dmg “interview tool.” The payload is not in the job description. It is in whatever you run before you verify who owns the domain and the GitHub org. Treat unsolicited hiring outreach like unsolicited wallet connects.

A lot of 3-of-5 multisigs are still one failure domain. Three keys in the same password manager, same laptop backup, or same cloud account does not give you three independent signers. It gives you one compromise path with extra ceremony. Threshold only works when the keys do not share recovery, devices, or people who can unlock each other.

A smart contract audit and a pen test answer different questions. The audit asks whether the bytecode holds up under adversarial input. The pen test asks whether someone can reach the keys, admin paths, deploy pipeline, or the frontend that talks to it. Fund only one and the other half of the stack stays untested.

Valid signed authorizations drained a multi-million vault this week. No broken Solidity required. If users can pre-sign spending permissions that stay live, a later phishing page only needs that signature, not the private key. Expiry, amount caps, and allowance inventories matter as much as the contract logic.

Another multi-chain hot wallet drain, cause listed as suspected private-key compromise. A contract audit does not cover the laptop that signs withdrawals. If that key lives on a box that also runs Discord, browser extensions, and random npm installs, the path is already open. Segregate signing. Treat the operator machine as hostile.

ERC-20 reentrancy is well understood, but `_safeMint` on NFTs still catches teams off guard. Because `_safeMint` triggers an external `onERC721Received` callback, writing state updates after the mint leaves an open reentrancy window. Follow checks-effects-interactions on NFT transfers, not just ERC-20s.

Giving an LLM agent direct wallet access without transaction limits is asking for a drain. Prompt injection doesn't just hijack chat responses. If the agent can sign transactions, a malicious payload in an untrusted web page or message becomes an arbitrary transfer. Enforce strict spending caps at the key level and isolate execution permissions.

A flawless smart contract audit won't save user funds if your Vercel or DNS credentials leak. Injecting a malicious permit modal into your site drains wallets without touching your contract logic. Treat frontend deployment access like an upgrade multisig key.

Refactoring code during an active smart contract audit seems harmless until a minor tweak breaks a core invariant. Changing logic post-scoping invalidates test coverage and wastes audit time on moving targets. Freeze the repo before audit kickoff.

Giving an AI agent direct wallet access turns prompt injection into an execution risk. If untrusted input reaches the LLM, it can trick the agent into signing malicious transactions. Security for autonomous tools belongs in hard execution limits, not prompt filters.