Book. Secure. Relax. Oak Security offers audits, penetration testing, training, and advisory.
Joined July 2021
- Tweets2.2K
- Following421
- Followers2.9K
- Likes11.2K
We have just published our audit report on @NVNM_Chain's upgradable ERC-20 implementation of NVMN Token. Read all about our findings and recommendations in the report:
github.com/oak-security/audi…
Oak Security retweeted
3 auditors on every line of code, none of them seeing the others' findings until a consensus meeting. That is how Oak Security describes its process, and blinding is what makes the 3 count as 3 and not 1 repeated.
Our Q3 research describes four Cosmos-ecosystem chains exploited through one unsigned-integer underflow in a shared upstream EVM-compatibility module.
Dependency risk also includes ordinary bugs propagating across deployments. Review the version you run, the assumptions you inherit and the local changes you made.
A dependency list tells you what you use. An authority map tells you what it can do.
For every vendor and upstream module: can it move funds, alter a trusted build, or change a security check? Who can revoke that authority?
About half of Q3's $1.07B in losses came from two supply-chain compromises.
Which vendor software can authorise transfers? Which build artefacts do users trust?
Our Q3 update: oaksecurity.io/research/blog…
🤖 Made with AI
ALT Oak Security Q3 2026 research: about half of the quarter's $1.07 billion losses came from two supply-chain compromises. External software modules connect to a custody chamber.
14 of the 20 protocols exploited in Q3 had been audited. That is a reason to examine security coverage, not a verdict on audit quality.
A prior audit does not tell you whether the exploited path was in scope, which version was reviewed, or which privileged systems changed afterward.
Our State of Web3 Security report now includes Q3 2026: $1.07B lost across 20 incidents. About half came from two supply-chain compromises.
Read the report and explore the dashboard: research.oaksecurity.io/
Incident data: @RektHQ.
Oak Security retweeted
Alex @0xhalloc and Jan @JphFritsche currently in Singapore for @token2049!
Come to our booth at the Nexus Startup Area to talk about the future of private payments.
New episode of @cyphertalkmedia.
In the future, will web3 wallets be the new cookies? Kyle says yes
🎙️ New episode: Kyle Den Hartog (@PryvitKyle), security engineer on the wallet at @brave .
- Why your wallet address is the new tracking cookie
- The browser as an attack surface
- The limits of ZK proofs.
🎧 cyphertalk.podbean.com/e/the…
We have just published our audit report of
ZIGChain v5 for @ZIGFinance. Read all about our findings and recommendations in the report:
github.com/oak-security/audi…
Building on @arbitrum? The Arbitrum Security Program is open for applications, with audit subsidies for eligible projects.
Oak Security is an approved auditor. Name Oak in the form’s “Preferred auditor” field.
Apply: tally.so/r/3xzEzv
🤖 Made with AI
ALT Oak Security announces its approved auditor status for the Arbitrum Security Program. A yellow-to-magenta ribbon connects a modular block structure and an audit checklist. Applications are open.
Oak Security retweeted
~1,783 wstETH, about $6M, drained from a vault on Base today. The attacker got a malicious contract added to the vault's whitelist, then used it to borrow aBaswstETH debt tokens and pull the underlying wstETH out.
We have just published our audit report of
@quipnetwork 's smart contracts and Ethereum SDK. Read all about our findings and recommendations in the report:
github.com/oak-security/audi…
We have just published our audit report of
@Valdora_finance 's @CosmWasm StZIG smart contract updates for the ZIGChain v5 migration. Read all about our findings and recommendations in the report:
github.com/oak-security/audi…
👀
ZisK v1.3.0-alpha release 🚀
ZisK is moving beyond arithmetic hashes with BLAKE3 strengthening security while outperforming our prior Poseidon1 version:
⚡ 7.43s p999 on 4×5090
⚡ 5.14s p999 on 8×5090
🛡️ 128-bit provable security
🔐 Post-quantum secure
This is a major step toward faster and safer proving.
Release notes: github.com/0xPolygonHermez/z…
We have just published our audit report of
@CoinList 's Ethereum smart contracts to support token sale and swap operations. Read all about our findings and recommendations in the report:
github.com/oak-security/audi…