- Publications from Trail of Bits
- Academic Papers
- White Papers
- Guides and Handbooks
- Conference Presentations
- Podcasts
- Webinars
- Public Comments
- Security Reviews
- Disclosures and exploits
- Workshops
- Datasets
- Service Overviews
- Legend
| Paper Title | Author(s) | Publication Date |
|---|---|---|
| Detecting Implicit Conversions in OpenVPN2 Using CodeQL | Paweล Pลatek | September 2025 |
| Preventing Account Takeovers on Centralized Cryptocurrency Exchanges Recommended Practices | Shaun Mirani, Kelly Kaoudis, and Evan Sultanik | Feb 2025 |
| Input-Driven Recursion: Ongoing Security Risks | Alexis Challande and Brad Swain | Dec 2024 |
| OpenSearch Benchmark Assessment | Evan Downing, Riccardo Schirone, Francesco Bertolaccini, and Ronald Eytchison | Aug 2024 |
| Cedar, Rego, and OpenFGA Policy Languages: Comparative Language Security Assessment | Ian Smith and Kelly Kaoudis | Aug 2024 |
| Toward Comprehensive Risk Assessments and Assurance of AI-Based Systems | Heidy Khlaaf | Mar 2023 |
| Are Blockchains Decentralized? Unintended Centralities in Distributed Ledgers | Evan Sultanik et al. | Jun 2022 |
| Do You Really Need a Blockchain? An Operational Risk Assessment | Evan Sultanik and Mike Myers | Jun 2022 |
| Link | Description |
|---|---|
| Testing Handbook | Guides for configuring and automating static and dynamic analysis tools |
| ZKDocs | Interactive documentation on zero-knowledge proof systems |
| Building Secure Smart Contracts | Best practices for developing secure smart contracts |
| CTF Field Guide | Field guide to winning at Capture The Flag competitions |
| Ruby Security Field Guide | Practical Ruby security guide |
| Presentation Title | Author(s) | Year |
|---|---|---|
| A Broad Comparative Evaluation of Software Debloating Tools | Michael D. Brown, Adam Meily, Eric Kilmer, Ronald Eytchison | 2024 |
| Repurposing LLVM analyses in MLIR: Also there and back again across the tower of IRs | Henrich Lauko | 2024 |
| VAST: MLIR for program analysis of C/C++ | Henrich Lauko | 2022 |
| A Broad Comparative Evaluation of x86-64 Binary Rewriters | Michael D. Brown | 2022 |
| On the Optimization of Equivalent Concurrent Computations | Henrich Lauko, Lukรกลก Korenฤik, Peter Goodman | 2022 |
| Presentation Title | Author(s) | Year |
|---|---|---|
| Weak Fiat-Shamir attacks on modern proof systems | Jim Miller | 2024 |
| Building a Rusty path validation library for PyCA Cryptography | William Woodruff | 2024 |
| Implementing X.509 path validation for Python | William Woodruff | 2024 |
| Careful with MAc-then-SIGn | Marc Ilunga | 2023 |
| die, PGP, die | William Woodruff | 2022 |
| Seriously, stop using RSA | Ben Perez | 2019 |
| Best Practices for Cryptography in Python | Paul Kehrer | 2019 |
| Analyzing the MD5 collision in Flame | Alex Sotirov | 2012 |
| Presentation Title | Author(s) | Year |
|---|---|---|
| Repeatable Benchmarking: An Exploration of OpenSearch vs Elasticsearch | Evan Downing | 2025 |
| Linux Security Event Monitoring with osquery | Alessandro Gario | 2019 |
| osql: The community oriented osquery fork | Stefano Bonicatti, Mark Mossberg | 2019 |
| Getting started with osquery | Lauren Pearl, Andy Ying | 2018 |
| osquery Super Features | Lauren Pearl | 2018 |
| osquery Extension Skunkworks | Mike Myers | 2018 |
| Build it Break it Fix it | Andrew Ruef | 2014 |
| Presentation Title | Author(s) | Year |
|---|---|---|
| Introduction to Semgrep and Semgrep Practice Exercises |
Maciej Domaลski, Matt Schwager, Spencer Michaels | 2024 |
| A mostly gentle introduction to LLVM | William Woodruff | 2022 |
| JWTs, and why they suck | Rory M | 2021 |
| The Joy of Pwning | Sophia D'Antoine | 2017 |
| How to CTF - Getting and using Other People's Computers (OPC) | Jay Little | 2014 |
| Low-level Security | Andrew Ruef | 2014 |
| Security and Your Business | Andrew Ruef | 2014 |
| Bringing nothing to the party | Vincenzo Iozzo | 2013 |
| From One Ivory Tower to Another | Vincenzo Iozzo | 2012 |
| Presentation Title | Author(s) | Year |
|---|---|---|
| Return to the 100 Acre Woods | Stefan Edwards | 2019 |
| Swimming with the kubectl fish | Stefan Edwards | 2019 |
| Presentation Title | Author(s) | Year |
|---|---|---|
| Incubated Machine Learning Exploits: Backdooring ML Pipelines Using Input-Handling Bugs | Suha Sabi Hussain | 2024 |
| Holistic ML Threat Models | Adelin Travers | 2024 |
| Using Graph-Based Machine Learning Algorithms for Software Analysis | Michael D. Brown | 2023 |
| Exploiting Machine Learning Pickle Files | Carson Harmon, Evan Sultanik, Jim Miller, Suha Sabi Hussain | 2021 |
| PrivacyRaven: Comprehensive Privacy Testing for Deep Learning | Suha Sabi Hussain | 2020 |
| Presentation Title | Author(s) | Year |
|---|---|---|
| Swift Reversing | Ryan Stortz | 2016 |
| Modern iOS Application Security | Sophia D'Antoine, Dan Guido | 2016 |
| The Mobile Exploit Intelligence Project | Dan Guido | 2012 |
| A Tale of Mobile Threats | Vincenzo Iozzo | 2012 |
| Presentation Title | Author(s) | Year |
|---|---|---|
| Python internals - let's talk about dicts | Dominik Czarnota | 2019 |
| Low-level debugging with Pwndbg | Dominik Czarnota | 2018 |
| Insecure Things to Avoid in Python | Dominik Czarnota | 2018 |
| Presentation Title | Author(s) | Year |
|---|---|---|
| Hardware side channels in virtualized environments | Sophia D'Antoine | 2015 |
| Exploiting Out-of-Order Execution | Sophia D'Antoine | 2015 |
| Presentation Title | Author(s) | Year |
|---|---|---|
| Attestations: a new generation of signatures on PyPI | William Woodruff | 2025 |
| The Next 5 Years of Supply Chain Security on PyPI | William Woodruff | 2024 |
| PEP 740 and PyPI: Bootstrapping Provenance for the Python Ecosystem | William Woodruff | 2024 |
| Imagining a zero-trust future for PyPI | William Woodruff | 2024 |
| Build Provenance: Lessons (so far) from Homebrew | Joe Sweeney | 2024 |
| What does it look like to code-sign for an entire packaging ecosystem? | William Woodruff | 2023 |
| Securing your Package Ecosystem with Trusted Publishing | William Woodruff | 2023 |
| Trusted Publishing: Lessons from PyPI | William Woodruff | 2023 |
| Ergonomic codesigning for the Python ecosystem with Sigstore | William Woodruff | 2023 |
| Sigstore for Python Packaging: Next Steps for Adoption | William Woodruff | 2022 |
| Python Packaging Mystery Meat | William Woodruff | 2022 |
| Automated Tools for Securing the Software Supply Chain | Michael D. Brown | 2022 |
| Improving PyPI's security with Two Factor Authentication | William Woodruff | 2019 |
| Presentation Title | Author(s) | Year |
|---|---|---|
| Peeling back the 'Shlayers' of macOS Malware | Josh Watson, Erika Noerenberg | 2019 |
| The Exploit Intelligence Project Revisited | Dan Guido | 2013 |
| Podcast | Guest | Date | Topic(s) |
|---|---|---|---|
| Risky Biz | Keith Hoodlet | Sep 2025 | AI prompt injections |
| Zero Signal | Keith Hoodlet | Sep 2025 | AI Security |
| Unsupervised Learning | Michael Brown | Aug 2025 | AIxCC |
| Security Weekly #342 | Will Vandevanter | Aug 2025 | NVIDIA vulnerability disclosure |
| CTF Radiooo 01E | Michael Brown & Evan Downing | Aug 2025 | AIxCC |
| Click Here Show | Dan Guido | Jun 2025 | Zoom remote control attacks |
| Security Weekly #336 | Artur Cygan | Jun 2025 | Fuzzing Barcodes |
| Protect AI | Keith Hoodlet | Jun 2025 | MCP Security |
| MLSecOps | Keith Hoodlet | Apr 2025 | AI/ML security |
| Risky Biz 786 | Tjaden Hess | Apr 2025 | Cryptography & blockchain |
| Security Weekly #323 | Keith Hoodlet | Mar 2025 | GenAI in Appsec |
| Xyonix | Keith Hoodlet | Mar 2025 | AI/ML security |
| Bugcrowd | Keith Hoodlet | Oct 2024 | AI/ML Bias |
| Risky Biz | Dan Guido | Oct 2024 | Post-quantum cryptography |
| Risky Biz 759 | Dan Guido | Aug 2024 | DARPA's AI Cyber Challenge |
| Resilience Rundown | Josiah Dykstra | May 2024 | Bias in security |
| Risky Biz | Dan Guido | Apr 2024 | Open source tooling |
| MLSecOps March 20 | William Woodruff | Mar 2024 | Supply chain security |
| yWhales | Dan Guido | Dec 2023 | Blockchain security |
| Risky Biz 707 | Dan Guido | May 2023 | ML security |
| ASW 229 | Nick Selby | Feb 2023 | Threat modeling, cloud-native audits |
| Risky Biz 690 | Dan Guido | Jan 2023 | Vuln disclosure |
| Risky Biz 672 | Dan Guido | Jul 2022 | Blockchain security |
| Cloud Security Reinvented | Nick Selby | Jun 2022 | Cloud security |
| Skiff Office Hours | Dan Guido | Mar 2022 | Privacy technology |
| Risky Biz 652 | Dan Guido | Jan 2022 | Zero-knowledge proofs |
| Secureum Safecast #3 | Josselin Feist | Nov 2021 | Blockchain security |
| Secureum Safecast #2 | Dan Guido | Oct 2021 | Blockchain security |
| Press Freedom Foundation | Dan Guido | Jul 2021 | Mobile security and iVerify |
| Employee Cycle | Hannah Hanks | Mar 2021 | First PeopleOps hire |
| Risky Biz 614 | Dan Guido | Feb 2021 | iVerify |
| Building Better Systems 6 | Dan Guido | Jan 2021 | What blockchain got right |
| WCBS 880 | Dan Guido | Sep 2020 | Gap years and intern hiring |
| Risky Biz 594 | Dan Guido | Aug 2020 | Apple security |
| Epicenter 346 | Dan Guido | Jun 2020 | Smart contract security |
| Absolute AppSec 97 | Stefan Edwards | May 2020 | Threat modeling |
| Unchained 170 | Dan Guido | May 2020 | DeFi security |
| Risky Biz 580 | Dan Guido | Apr 2020 | Mobile voting |
| Absolute AppSec 91 | Stefan Edwards | Apr 2020 | Mobile voting |
| Zero Knowledge 122 | Ben Perez | Mar 2020 | Cryptography reviews, ZKPs |
| Changelog | Dan Guido | Jan 2020 | AlgoVPN |
| Risky Business 559 | Stefan Edwards | Oct 2019 | Kubernetes |
| FOSS Weekly 545 | William Woodruff | Sep 2019 | PyPI security improvements |
Podcast.__init__ 225 |
William Woodruff | Aug 2019 | PyPI security, UX, and sustainability |
| Absolute AppSec 68 | Stefan Edwards, Bobby Tonic | Aug 2019 | Kubernetes |
| Hashing it Out 53 | Dan Guido | Jul 2019 | Smart contract testing |
| Absolute AppSec 60 | Stefan Edwards | May 2019 | Android, programming languages |
| Absolute AppSec 55 | Stefan Edwards | Apr 2019 | Security testing |
| Hashing it Out 35 | Dan Guido, Josselin Feist | Jan 2019 | Ethereum's failed EIP-1283 |
| Risky Biz 526 | JP Smith | Jan 2019 | Post-quantum crypto in CTFs |
| Absolute AppSec 37 | Stefan Edwards | Nov 2018 | Programming languages, symbex |
| Risky Biz 510 | Lauren Pearl | Aug 2018 | Open source security engineering |
| Absolute AppSec 34 | Stefan Edwards | Oct 2018 | Security testing, blockchain |
| Zero Knowledge 16 | JP Smith | Mar 2018 | Smart contract security |
| Risky Biz 488 | JP Smith | Feb 2018 | Smart contract testing w/ Manticore |
| Risky Biz 474 | Dan Guido | Oct 2017 | How to engineer secure software |
| Georgian Partners 47 | Dan Guido | May 2017 | AlgoVPN and Tor |
| VUC 643 | Dan Guido | Apr 2017 | AlgoVPN |
| Risky Biz 449 | Dan Guido | Mar 2017 | Control Flow Integrity |
| Risky Biz 425 | Dan Guido | Sep 2016 | Recap the week's news |
| Risky Biz 421 | Dan Guido | Aug 2016 | Car hacking and the week's news |
| Risky Biz 416 | Dan Guido | Jul 2016 | DARPA Cyber Grand Challenge |
| Risky Biz 399 | Dan Guido | Feb 2016 | Apple vs the FBI |
| Risky Biz 370 | Dan Guido | Feb 2015 | DARPA Cyber Grand Challenge |
| Risky Biz 348 | Dan Guido | Jun 2015 | DARPA Cyber Grand Challenge |
| Title | Speakers | Date |
|---|---|---|
| MCP Security Deep Dive: From Attacks to Defense | Keith Hoodlet, Cliff Smith, Vineeth Sai Narajala, Manish Bhatt | Jul 2025 |
| Security Audits: Best Practices with Trail of Bits | Chris Dahlheimer, Lindsay Rakowski, & Vanessa Gennarelli | Mar 2025 |
| Mastering Web Research with Burp Suite | Keith Hoodlet, Cliff Smith, & James Kettle | Jun 2024 |
| Introduction to CodeQL: Examples, Tools and CI Integration | Filipe Casal & Fredrik Dahlgren | Mar 2024 |
| Introduction to Semgrep | Maciej Domanski & Matt Schwager | Jan 2024 |
| Topic | Agency | Date |
|---|---|---|
| Automated Artifical Intelligence Bill Of Materials for AI/ML Ops | U.S. Army PEO IEW&S | Dec 2023 |
| Open-Source Software Security: Areas of Long-Term Focus and Prioritization | ONCD, CISA, NSF, DARPA, OMB | Nov 2023 |
| Understanding the National Security Implications of AI | Whitehouse OTSP | Jul 2023 |
| AI Accountability, Regulation, and Audits | NTIA | Jun 2023 |
| A Comprehensive Risk Assessment Framework for AI Assurance in Ethical, Legal, and Societal Domains | DARPA | Jun 2023 |
| Understanding Crypto Markets Security | CFTC | Mar 2023 |
| Regulation of Intrusion and Surveillance Software | Commerce Dept | Jul 2015 |
Companies that have allowed us to speak about our work can be found here. Many more remain confidential.
The following clients have engaged Trail of Bits for 5 or more security reviews:
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| Scroll Feynman Upgrade Smart Contract Changes | Jul 2025 | 1 | ๐ | |
| Scroll Euclid Phase 2 | Apr 2025 | 4 | Scroll | ๐โ ๐ |
| Scroll Euclid Phase 1 | Apr 2025 | 3 | Scroll | ๐โ ๐ |
| Scroll zstd Compression | Jun 2024 | 12 | ๐โ | |
| Scroll ZkEVM 4844 Blob | Apr 2024 | 6 | ๐โ | |
| Scroll ZkEVM Wave 3 | Sep 2023 | 9 | ๐โ | |
| Scroll l2geth [diff] | Aug 2023 | 2 | ๐ | |
| Scroll l2geth [initial] | Aug 2023 | 2 | ๐ | |
| Scroll ZkEVM Wave 2 | Aug 2023 | 6 | ๐โ | |
| Scroll zkTrie | Jul 2023 | 4 | ๐โ | |
| Scroll ZkEVM Wave 1 | Apr 2023 | 23 | ๐โ |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| Uniswap v4 Core | Jul 2024 | 6 | ๐โ | |
| Uniswap Browser Extension | Feb 2024 | 6 | ๐โ | |
| Uniswap | Sep 2023 | 4 | ๐โ | |
| Uniswap Mobile Wallet | Aug 2022 | 4 | ๐โ | |
| Uniswap V3 Staker | Jun 2021 | 2 | ||
| Uniswap V3 | Mar 2021 | 10 | Uniswap | ๐ |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| FraxGov | May 2023 | 4 | ๐โ | |
| Fraxlend and veFPIS | Jan 2023 | 4 | ||
| Fraxlend and FraxFerry | Oct 2022 | 4 | ๐ | |
| Frax | May 2022 | 4 | ๐ | |
| Frax | Dec 2021 | 4 | ๐ | |
| Frax | May 2021 | 4 | ๐ |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| Reserve Protocol Solidity 4.0.0 | Jun 2025 | 3.6 | ๐โ | |
| Reserve Protocol Solana DTFs | Apr 2025 | 2 | ๐โ | |
| Reserve Folio Solidity-Based Contracts | Apr 2025 | 2 | ๐โ | |
| Reserve Protocol | Aug 2022 | 8 | ๐, โ | |
| Reserve Protocol | Mar 2019 | 1 | ๐ |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| MobileCoin | Jul 2022 | 2 | ๐ | |
| Fog Protocol | Jan 2021 | 4 | ๐ | |
| MobileCoin BFT | Oct 2020 | 4 | ๐ | |
| MobileCoin | Aug 2020 | 4 | ๐ |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| ArmorLock | Apr 2022 | 6 | ||
| Optimus ROM | Jan 2022 | 4 | ||
| Secure Transport | Apr 2020 | 4 | ||
| Western Digital Sweet B | Jan 2020 | 4 | Western Digital | ๐ |
| SanDisk X600 | May 2019 | 6 | Multiple vulnerabilities in SanDisk X600 | ๐ |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| YOLOv7 | Oct 2023 | 4 | ๐ | |
| SafeTensors | Mar 2023 | 2 | ๐ |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| KEDA | Dec 2022 | 6 | OSTIF | ๐ |
| Terraform Enterprise | Nov 2022 | 6 | ||
| Nomad Enterprise | Nov 2022 | 6 | ||
| HashiCorp Cloud | Jun 2022 | 9 | ||
| Tekton | Mar 2022 | 4 | Tekton Security Review Completed | ๐ |
| Linkerd | Feb 2022 | 4 | ๐๐โ | |
| CoreDNS | Jan 2022 | 4 | ๐ | |
| Terraform Enterprise | Nov 2021 | 6 | ||
| Nomad Enterprise | Nov 2021 | 6 | ||
| Consul Enterprise | Oct 2021 | 6 | ||
| Vault Enterprise | Oct 2021 | 6 | ||
| HashiCorp Cloud | Jun 2021 | 8 | ||
| Argo | Mar 2021 | 4 | ๐๐ | |
| Terraform Cloud | Jan 2021 | 6 | ||
| Consul | Oct 2020 | 10 | ||
| Nomad | Aug 2020 | 6 | ||
| Helm | Aug 2020 | 4 | Helm 2nd Security Audit | ๐ |
| Terraform | Mar 2020 | 6 | ||
| OPA | Mar 2020 | 2 | Open Policy Agent (OPA) Graduation Proposal | ๐ |
| etcd | Jan 2020 | 4 | CNCF | ๐ |
| Rook | Dec 2019 | 2 | CNCF | ๐ |
| Kubernetes | May 2019 | 12 | Google, CNCF | ๐๐๐ฐ |
| Product | Date | Level of Effort |
Announcement | Report | Public Suite |
|---|---|---|---|---|---|
| Panoptic | May 2024 | 9 | ๐ | ||
| Curvance | Mar 2024 | 5 | ๐ | Public invariants |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| Gemini Smart Wallet | August 2025 | 4 | ๐โ | |
| Gemini Smart Wallet | August 2025 | 4 | ๐ | |
| Otim Smart Wallet | Mar 2025 | 3 | ๐โ | |
| dappOS v2 wallet | Jul 2023 | 3 | ๐โ | |
| WalletConnect v2.0 | Mar 2023 | 4 | WalletConnect | ๐โ |
| Phantom Wallet | Nov 2022 | 2 | ||
| GameStop iOS Web Wallet | Nov 2022 | 1 | ||
| GameStop Wallet | Mar 2022 | 2 | GameStop wallet | |
| RAILGUN | Feb 2022 | 4 | ||
| Casper Web Wallet | Jul 2021 | 4 | ๐ | |
| Argent | Aug 2020 | 4 | ||
| Magma | Jun 2020 | 1 | ๐ | |
| Dharma Wallet | Oct 2019 | 4 | ๐ | |
| ZecWallet | Apr 2019 | 2 | ๐ | |
| Web3 | Mar 2018 | 2 | W3F and TOB hardware wallet guidance | ๐ฌ |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| Folks Finance Protocol | Nov 2022 | 6 | ๐โ | |
| wXTZ | Nov 2020 | 4 | ๐ | |
| wALGO | Nov 2020 | 4 | ๐ | |
| Meld Gold | Jul 2020 | 2 | ||
| Pixel | Dec 2019 | 4 | ||
| Algorand | Mar 2019 | 14 | Success and momentum of Algorand |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| Alkimiya Silica V2 | Jun 2022 | 6 | ||
| Ava Labs | Apr 2022 | 8 | ||
| Flare Network | Mar 2021 | 8 |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| ZetaChain Bitcoin Inscriptions | Jan 2025 | 2 | ๐โ | |
| Nomic | Nov 2024 | 10 | Nomic | ๐โ |
| STAS SDK | Oct 2021 | 4 | ||
| STAS-JS SDK | Sep 2021 | 4 | ||
| Bitcoin SV | Jan 2021 | 6 | ||
| Zcoin | Jul 2020 | 2 | Zcoin | ๐ |
| Zcash | Apr 2020 | 3 | Electric Coin Co. | ๐ |
| Zcash | Nov 2019 | 6 | NU3, Blossom, and Sapling security reviews | ๐ |
| Zcash | Nov 2019 | 6 | ๐ | |
| Paymail Protocol | Nov 2019 | 7 | ||
| Bitcoin SV | Nov 2018 | 12 | ||
| Simple Ledger | Oct 2019 | 3 | ||
| RSKj | Nov 2017 | 6 | RSK security audit results | ๐ |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| xUDT | Jun 2021 | 2 | ||
| Nervos -RSA | Mar 2021 | 4 | ||
| Cheque Cell & ORU | Feb 2021 | 8 | ||
| Force Bridge - Solidity | Feb 2021 | 4 | ||
| Force Bridge - Rust | Feb 2021 | 3 | ||
| Nervos SUDT | Oct 2020 | 6 | ๐ |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| Opus | Dec 2023 | 8 | ๐โ | |
| Aura | Aug 2023 | 8 | ๐โ | |
| Nostra | Dec 2022 | 8 | ||
| StarkGate | Dec 2022 | 2 | ||
| StarkEx | Oct 2022 | 1 | ||
| StarkNet token | Jul 2022 | 1 | ||
| StarkPerpetual | Jan 2022 | 8 | ||
| StarkEx | Nov 2021 | 8 |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| Solang Code Generation | November 2023 | 4 | ๐ | |
| Solang Code Generation, Part 1 | November 2023 | 2 | ๐ | |
| Solang Parser and Semantic Analysis | September 2023 | 2 | ๐ | |
| Solang Solana Library | July 2023 | 1 | ๐ | |
| Franklin Templeton Benji Contracts | Feb 2025 | 2 | ๐โ | |
| ZetaChain Solana Gateway | Jan 2025 | 1 | ๐โ | |
| Squads V4 | Oct 2023 | 2 | Squads | ๐โ |
| Token-2022 Program | Feb 2023 | 1 | ๐โ | |
| Drift Protocol | Dec 2022 | 6 | Drift | ๐โ |
| Solana | Apr 2022 | 12 |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| zkVerify | Feb 2025 | 3 | ๐ | |
| ParaSpace | Dec 2022 | 1 | ๐ | |
| ParaSpace | Nov 2022 | 7 | ๐โ | |
| Parallel Finance | Mar 2022 | 6 | ๐ | |
| Polkadex | Feb 2022 | 10 | ||
| Polkadex | Dec 2021 | 4 | ||
| PINT | Sep 2021 | 4 | ||
| Polkaswap | Aug 2021 | 6 | ๐ | |
| AlephBFT | Jun 2021 | 4 | ๐ | |
| Acala Network | Jun 2021 | 4 | ||
| Compound Chain | May 2021 | 6 | ||
| Acala Network | Jan 2021 | 6 | ๐ | |
| Parity Fether | Aug 2019 | 4 | ||
| Parity | Jul 2018 | 12 | Parity completes Trail of Bits security review | ๐ |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| Orga and Merk | Nov 2024 | 10 | Orga & Merk Trail of Bits Security Audit | ๐โ |
| Berachain polaris-geth | Aug 2023 | 8 | ||
| Berachain berachain | Jun 2023 | 6 | ||
| Umee | Feb 2022 | 8 | ๐ | |
| Columbus-5 | Jan 2022 | 2 | ||
| IBC Protocol | Dec 2021 | 4 | ||
| THORChain | Aug 2021 | 12 | ||
| Tendermint | Mar 2019 | 12 | ||
| ndau | Nov 2018 | 8 | Policy Council |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| Kolibri | Apr 2022 | 4 | ||
| Tezori (T2) | Dec 2020 | 4 | ๐ | |
| Dexter | Jun 2020 | 4 | ๐ | |
| Tezori | Jul 2018 | 2 | Thanks to @trailofbits for their security review |
| Product | Date | Level of Effort |
Announcement | Report |
|---|---|---|---|---|
| EVAA Finance | Aug 2025 | 8.6 | ๐โ | |
| Swap Coffee TON DEX | Jul 2025 | 6 | ๐โ | |
| FIVA Yield Protocol | May 2025 | 6 | ๐โ | |
| FIVA Evaa Integration | May 2025 | 6 | ๐โ | |
| Whales Holders | May 2025 | 4 | ๐โ | |
| Whales Nominators | May 2025 | 4 | ๐โ | |
| STON.fi DEX V2 | Jan 2025 | 8 | ๐โ | |
| Tact Compiler | Jan 2025 | 8 | ๐โ | |
| TON Foundation Multisignature Wallet | Mar 2024 | 4 | ๐โ |
Check the exploits repository too.
| Name | Product | Discoverer | Year | ID | Blog |
|---|---|---|---|---|---|
| User to root privilege escalation from an integer overflow in libinfo | macOS | Paweล Pลatek | 2025 | CVE-2025-24195, CVE-2025-31222, CVE-2025-30440 | ๐ฌ |
Crash due to uncontrolled recursion in Well-KnownText |
Elastic | Alexis Challande, Brad Swain | 2024 | CVE-2024-52981 | |
Crash due to uncontrolled recursion in innerForbidCircularReferences |
Elastic | Alexis Challande, Brad Swain | 2024 | CVE-2024-52980 | |
| Crash due to uncontrolled recursion in Wire | Wire | Alexis Challande, Brad Swain | 2024 | CVE-2024-58103 | |
| Crash due to uncontrolled recursion in protobuf crate | rust-protobuf | Alexis Challande, Brad Swain | 2024 | RUSTSEC-2024-0437 | |
| Denial of Service in XStream | XStream | Alexis Challande, Brad Swain | 2024 | GHSA-hfq9-hggm-c56q | ๐ฌ |
| Denial of Service in protobuf-java | protobuf-java | Alexis Challande, Brad Swain | 2024 | GHSA-735f-pc8j-v9w8 | ๐ฌ |
| Insufficient validation of integration timestamp in sigstore-python | sigstore-python | William Woodruff | 2024 | CVE-2024-55655 | |
| Rust crates "stable" and "nightly" might be installed instead of the corresponding toolchains | Crates.io | Max Ammann | 2024 | โ | |
| num-bigint disclosure | num-bigint | Samuel Moelius | 2024 | โ | ๐ฌ |
| Memory corruption during X.509 validation in GnuTLS | GnuTLS | William Woodruff | 2024 | CVE-2024-28835 | |
| Linux kernel modules kASLR bypass | Linux | Dominik Czarnota | 2024 | โ | ๐ฌ |
| Pedersen DKG vulnerability disclosure | Multiple | Fredrik Dahlgren | 2024 | None | ๐ฌ |
| LeftoverLocals disclosure | multiple GPUs | Tyler Sorensen | 2024 | CVE-2023-4969 | ๐ฌ |
| Billion hashes attack against Go JOSE libraries | go-jose | Matt Schwager | 2023 | GO-2023-2334, GO-2023-2409 | ๐ฌ |
| Expo Secure Store: Shortening AES GCM Authentication Tags | expo-secure-store | Joop van de Pol | 2023 | โ | ๐ฌ |
| YOLOv7 disclosure | YOLOv7 | Alvin Crighton, Anusha Ghosh, Suha Hussain, Heidy Khlaaf, Jim Miller | 2023 | โ | ๐ฌ |
| Numbers turned weapons: DoS in Osmosisโ math library | Osmosis | Sam Alws | 2023 | โ | ๐ฌ |
| The issue with ATS in Appleโs macOS and iOS | iOS, iPadOS, tvOS, macOS, and watchOS | Will Brattain | 2023 | CVE-2023-38596 | ๐ฌ |
| Eth ABI DoS disclosure | ethabi, eth_abi, etheriumjs-abi, alloy-rs | Max Ammann | 2023 | โ | |
| Security flaws in an SSO plugin for Caddy | caddy-security | Maciej Domanski, Travis Peters, David Pokora | 2023 | CVE-2024-21500, CVE-2024-21499, CVE-2024-21498, CVE-2024-21497, CVE-2024-21496, CVE-2024-21493, CVE-2024-21495, CVE-2024-21494, CVE-2024-21492, CVE-2023-52430 | ๐ฌ |
| ktor Path Traversal | ktor | Vasco Franco | 2023 | CVE-2022-48476 | |
| Specialized Zero-Knowledge Proof failures | Binance's tss-lib; All forks of tss-lib: Joltify, SwipeChain, and ThorChain; Coinbase's kryptology | Opal Wright | 2022 | โ | ๐ฌ |
| Forgery in Amis' Alice library | Amis' alice | Filipe Casal | 2022 | โ | |
| Keeping the wolves out of wolfSSL | wolfSSL | Max Ammann | 2022 | CVE-2022-38152 CVE-2022-38153 CVE-2022-39173 CVE-2022-42905 | ๐ฌ |
| Escaping misconfigured VSCode extensions - Live Preview XSS | Live Preview VSCode extension | Vasco Franco | 2022 | MS-VULN-073448 | ๐ฌ |
| Escaping misconfigured VSCode extensions - Live Preview Path Traversal | Live Preview VSCode extension | Vasco Franco | 2022 | MS-VULN-073447 | ๐ฌ |
| Escaping well-configured VSCode extensions (for profit) - VSCode localResourceRoots Bypass | VSCode | Vasco Franco | 2022 | CVE-2022-41042 | ๐ฌ |
| Escaping misconfigured VSCode extensions - Sarif Viewer XSS | Sarif Viewer VSCode extension | Vasco Franco | 2022 | MS-VULN-071828 | ๐ฌ |
| Stranger Strings: An exploitable flaw in SQLite | SQLite | Andreas Kellas | 2022 | โ | ๐ฌ |
| json-viewer XSS | jquery.json-viewer | Vasco Franco | 2022 | CVE-2022-30241 | |
| Shamirโs Secret Sharing vulnerabilities | Binanceโs tss-lib; Clover Networkโs threshold-crypto; Keep Networkโs keep-ecdsa; Swingbyโs tss-lib; THORchainโs tss-lib; ZenGo Xโs curv | Filipe Casal | 2021 | โ | ๐ฌ |
| OSX slack:// protocol handler javascript injection | Slack | Jay Little | 2016 | โ | ๐ฌ |
| Double free in VLC's 3GP file format | VLC | Loren Maggiore | 2015 | CVE-2015-5949 | ๐ฌ |
| Workshop Title | Venue | Date |
|---|---|---|
| Smart Contract Security Automation | TruffleCon 2019 | Oct 2019 |
| Introduction to Smart Contract Exploitation | GreHack 2018 | Nov 2018 |
| Manticore EVM Workshop | Devcon4 2018 | Nov 2018 |
| Smart Contract Security Automation | TruffleCon 2018 | Oct 2018 |
| DeepState: Bringing Vulnerability Detection Tools into the Dev Cycle | SecDev 2018 | Oct 2018 |
| Smart Contract Security Automation | ETH Berlin 2018 | Sep 2018 |
| Manticore EVM Workshop | EthCC 2018 | Mar 2018 |
| Manticore Workshop | GreHack 2017 | Oct 2017 |
| Dataset | Date |
|---|---|
| Smart Contract Audit Findings | Aug 2019 |
| Service Title | Type of Document |
|---|---|
| AI Safety & Security Training | One-page service overview |
| Icon | Definition |
|---|---|
| ๐ฌ | Blog post or other social media |
| ๐ | Security Assessment report |
| โ | Fix review report |
| ๐ | Letter of Attestation |
| ๐ | Threat Model report |
| ๐ฐ | Whitepaper |
| Header | Definition |
|---|---|
| Level of Effort | Defined in person-weeks for the project |
