Gravitational plate of three masses and a slashed discABC0Static engraved plate. Three-dimensional view is unavailable or reduced motion is requested.

← back to fieldarticle

article

Article

  1. Aug 5, 2025/articleGroth16From arithmetic circuits through R1CS and QAP to Groth16's three-element proof, trusted setup toxic waste, and the single pairing verification equation.
  2. Aug 1, 2025/articleAnalysis of ZKP implementation vulnerabilities: under-constrained inputs and Frozen HeartHow missing binary constraints on MultiMux1 selectors break BinaryMerkleRoot/Semaphore membership proofs, and how omitting public inputs from Fiat–Shamir transcripts enables Frozen Heart forgery in PlonK implementations.
  3. Jul 31, 2025/articleDeposit Forwarder SystemArchitecture for per-user deterministic deposit contracts: factory, master forwarder roles, and ETH/ERC-20 forward flows for an exchange backend.
  4. Jul 23, 2025/articleExploring KZG polynomial commitmentsWhy constant-size polynomial commitments beat per-coefficient Pedersen commits, how pairings and t-SDH/t-BSDH underwrite KZG, and the Setup / Commit / CreateWitness / VerifyEval flow.
  5. Jul 6, 2025/articleExploring PlonKProver-side walkthrough of PlonK: gate and wiring constraints, polynomial compilation, the five proof rounds, and how the verifier checks the batched opening.
  6. Dec 20, 2023/articleBlockchain data availability and blobspaceHow light clients face the data availability problem, what Celestia, EigenDA, and DACs change, and how EIP-4844 blobs, KZG, and danksharding reshape rollup throughput.
  7. Mar 3, 2023/articleBlockchain infrastructure and consensus protocol securityStudy notes on PoW vs PoS, finality, and BFT- versus chain-based stake protocols, framed by a survey of long-range attacks on Proof-of-Stake.
  8. Mar 3, 2023/articleLong-range attacks on Proof of Stake — survey notesStudy notes on long-range attacks in PoS: costless simulation, weak subjectivity, simple / posterior-corruption / stake-bleeding variants, and why no single mitigation closes the class.
  9. Feb 2, 2023/articleUniswap V2 math and contract reviewCPMM price rules, marginal price, TWAP oracle, flash swaps, EIP-712 permits, UQ112.112 fixed-point, protocol fees, sync/skim, and a walk through v2-core and v2-periphery.
  10. Jan 30, 2023/articleAMM and PMM mechanisms: math beyond the limit order bookFrom LOB limits to AMM conservation functions: actors, assets, slippage, divergence loss, and a state-space formalization of swaps and liquidity changes.
  11. Jan 25, 2023/articleEthereum P2P eclipse attacks (geth-era study notes)Paper notes on low-resource eclipse attacks against Ethereum's Kademlia-style discovery: why ECDSA node IDs and connection bias mattered before geth v1.8, and what changed.
  12. Jan 19, 2023/articleEVM storage layout collisions and upgradeable proxiesHow Solidity packs storage slots, how proxy + delegatecall share that layout, where upgradeable proxies collide, and the usual mitigations (EIP-1967-style slots, initializers, pattern choices).
  13. Aug 4, 2022/articleUniswapV2 subgraph event queriesHow The Graph indexes contract events: subgraph manifests, GraphQL schemas, AssemblyScript handlers, and a local graph-node deploy for a Swapper-style Uniswap flow.
  14. Aug 3, 2022/articleUniswap V2 smart contractsUniswap V2 core and periphery: Factory, Pair, Router, LP tokens, mint/burn/swap paths, reserve updates, and a swapper/subgraph lab section.
  15. Aug 1, 2022/articleSolana programs and Web3 APIWalkthrough of Solana web3.js patterns: connect, keypair, airdrop, transfer, deploy a hello-world program, create greeting accounts, and read/write on-chain state.
  16. Jul 31, 2022/articleSolana transactionsHow Solana transactions bundle instructions, list accounts up front for parallel execution, and charge deterministic fees with a recent blockhash.
  17. Jul 31, 2022/articleSolana on-chain programsHow Solana separates executable programs from account data, what native and SPL programs provide, and how Rust programs are structured and deployed.
  18. Jul 31, 2022/articleSolana accounts modelHow Solana accounts store state: data vs program accounts, PDA limits, ownership rules, rent, and the fields every account carries.
  19. Jul 31, 2022/articleSolana Program Derived AddressesHow Solana PDAs are discovered off the ed25519 curve via seeds and bumps, signed with invoke_signed, and used as program-controlled account indexes.
  20. Dec 31, 2021/articleCloud Vulnerability Lab 6 (CloudGoat: EC2 SSRF)CloudGoat EC2 SSRF path: Solus reads Lambda env keys for Wrex, SSRF hits IMDS, S3 yields Shepard admin creds, then invoke the target Lambda.
  21. Dec 31, 2021/articleCloud service vulnerability analysis 5 (CloudGoat: IAM privilege escalation by attachment)CloudGoat iam_privesc_by_attachment: from Kerrigan's limited IAM user, swap a meek instance profile for a mighty role, launch an EC2 foothold, and terminate the super-critical server.
  22. Dec 31, 2021/articleCloud Service Vulnerability Lab 4 (CloudGoat: Cloud Breach S3)Walkthrough of CloudGoat's cloud_breach_s3 scenario: abuse a misconfigured reverse proxy to reach IMDS, steal the instance-profile keys, and sync confidential objects out of a private S3 bucket.
  23. Dec 31, 2021/articleCloud Vulnerability Lab 2 (CloudGoat: IAM Privilege Escalation by Rollback)CloudGoat walkthrough: start as limited IAM user Raynor, find SetDefaultPolicyVersion, roll back to a policy version with full admin, and confirm the privilege jump.
  24. Dec 31, 2021/articleCloud service vulnerability analysis 0: overviewSeries opener on cloud security: public vs private clouds, OpenStack/Nova basics, and AWS IAM, EC2, S3, and Lambda as the usual attack surface.
  25. Dec 26, 2021/articleWeb Application SSRF / XXE / SSTI Research NotesPractical notes on SSRF (including gopher into MySQL), XXE (file read and blind OOB), and Jinja2 SSTI sandbox escape via MRO and subprocess.
  26. Dec 24, 2021/articleVulnerability analysis of commercial metaverse-based virtual office platformsBoB MetaVersPloit team report: methodology, common features, and attack impact across Gather, oVice, Kumospace, Spatial, and Horizon Workrooms — 31 findings in four months.
  27. Mar 1, 2021/articleLinked-List Attack Surface on Intel (Structure Notes)Singly linked list layout, insert/remove helpers, and Intel disassembly of nodeAlloc/nodeSet/Init/frontInsert/rearInsert/rearRemove with IDA struct recovery and heap traces.
  28. Dec 20, 2020/articleSQLite3 fts3_tokenizer() Remote Code Execution ResearchHow a PHP sandbox with disabled system functions can still fall to RCE via SQLite3 fts3_tokenizer: leak the module base, hijack tokenizer callbacks, pivot the stack, and call system on both x86 and x86_64.
  29. Sep 18, 2020/articleSSTF 2020 t_express WriteupHeap note on t_express: off-by-one ticket_type overwrite, negative index stderr leak, tcache key forge for double free, then __free_hook to system.
  30. Sep 18, 2020/articleDEF CON 2016 xkcd writeupStatically linked xkcd challenge: a heartbeat-style reply buffer sits 0x200 bytes before the flag in .bss, so an overstated length turns strlen into an out-of-bounds read.
  31. Sep 18, 2020/articleDEF CON 2016 feedme Vulnerability AnalysisWriteup for DEF CON 2016 feedme: fork-stable canary brute-force across child processes, then a static-binary ROP chain to read /bin/sh into .bss and execve.
  32. Aug 16, 2020/articleHITCON 2017 Sakura writeupHITCON 2017 Sakura: 400 bytes of input feed a huge sub_850 checker; angr finds satisfying paths by locating the shared false-store pattern and exploring every third true branch.
  33. Aug 15, 2020/articleCodeGate 2017 angrybird writeupCodeGate 2017 angrybird: patch early exits and canary-related checks, then use angr from 0x4007c2 to recover the 20-byte input that reaches the final printf.
  34. Aug 14, 2020/articleUsing angr for Binary Analysis, Part 3Walkthrough of the fauxware sample with angr: find the accept path, avoid the reject branch, and recover inputs from forked simulation states.

graphfeed