If your backend or relayer acts on an emitted event, it can be lied to. The EVM never checks that a log matches the state it claims. A contract can emit a transfer that moved nothing. EventSpec reproduced it on bridge relayers. arxiv.org/abs/2609.07865 A log is a claim, not a receipt.

Does your protocol give out anything per address? High severity issue we found while auditing a raffle project. An address with one Wei staked had the same odds of winning as the largest staker. 1️⃣ Project summary Lotus is a staking protocol. You lock LOTUS, your position earns shares, and five percent of every reward distribution funds a separate raffle pool. Every two weeks that pool pays its whole jackpot, in TITANX, to one staker, drawn with Chainlink VRF. 2️⃣ The bug The pool holds its participants as a set of addresses, and the draw is one line, index into that set with the random word. One address, one ticket. Stake size doesn't appear in that line. Entering the set was a side effect of staking, with no threshold of its own. One share put an address in, and one share was one wei of LOTUS. The randomness was never the problem. What the random number indexed into was. 3️⃣ The attack path 1. Stake a wei of LOTUS from an address. That address is now a ticket. 2. Repeat from a substantial number of addresses. 3. Every honest staker's odds drop, whatever they locked. The protocol priced a raffle ticket in gas and priced everything else in stake. 4️⃣ Fix The client shipped a minimum stake to enter the draw. Run the split test on anything you weight. If splitting one position across ten addresses beats holding one, you don't have a weighting, you have a headcount. If you have the same pattern in your codebase, contact us so you don't repeat the same mistake. egissec.net

Do you review your own contracts before an audit? @AwareXone has skills that cover 10 different bug classes using a knowledge base consisting of target scoring, bug patterns, grep arsenal, PoC templates and real case studies. Check them out below ⬇️

If every user of your protocol delegatecalls into one shared helper contract, this affects you too. On 1st of September, four forgotten Reflexer vaults were drained for 5.9436 ETH by two rules that are both correct. 1️⃣ Summary Reflexer's GEB is the engine behind RAI, a stablecoin you mint by locking ETH in your own vault. Nobody calls the vault manager directly. You delegatecall a shared helper from your own proxy, so address(this) is your proxy, recorded as the owner. 2️⃣ The bug Rule one, record address(this) as the owner. Correct under delegatecall. Rule two, let only the recorded owner move a vault's balance. Correct on its own. In 2020 someone reached the helper as a plain call instead of through a proxy. address(this) was then the helper itself, so vaults 3, 5, 8 and 18 ended up owned by a shared contract whose migration function, quitSystem, is public and unchecked. The manager compares the caller to the recorded owner, sees the helper on both sides, and says yes. Nothing was bypassed. 3️⃣ Attack path 1. Reflexer has been in permanent settlement since January 2021, so anyone may cancel a vault's debt. Do that for all four, leaving debt free ETH in each. 2. Call that migration function directly, once per vault, moving every balance to a handler you control, then exit through the ETH adapter. Four vaults, one transaction, five years after that owner field was written. Delete either rule and the ETH is still there. An access check is only as trustworthy as whatever filled in its owner field. If you have the same pattern in your codebase, contact us so you don't repeat the same mistake. egissec.net

Website redesign is 95% complete, stay tuned.

To all protocols that plan for a security review. The singles most important thing you can do, is give a correct scope for the audit. A new ack3 preprint mapped 135 DeFi incidents from H1 2026. Of the 68 with a prior audits, 46 were exploited in code the audit never covered. A malformed scope can lead to disastrous consequences. @EgisSec doesn't look blindly into your scope, if something marked out of scope is necessary to be reviewed, we'll tell you.

Do you fuzz your contracts? You should. Ultrafuzz is Monad's open source agentic fuzzing orchestrator. github.com/monad-developers/…

Public service announcement to all crypt founders.