Blog
Research notes, audit learnings, and practical best practices from our team.
EIP-8130 / EIP-8141: what auditors should care about
TL;DR: EIP-8130 and EIP-8141 represent two different approaches to deeper native account abstraction. Ethereum has scheduled EIP-8141 for inclusion in the planned Hegotá upgrade, while EIP-8130 remains a separate Base-led draft. Neither is active on Ethereum mainnet today, and both specifications ca
Q3 2026 Web3 Exploit Report
How Protocols Got Drained The third quarter of 2026 is the most damaging quarter in Web3 security so far this year. CD Security tracked 146 security incidents across July, August, and September - protocol exploits, infrastructure breaches, wallet compromises, bridge failures, and other technical att
The Philosophy Behind CD Security
CD Security was built around a simple idea: great security comes from experienced auditors, direct communication, fast and careful execution, and people who actually care about the outcome of the audit. We never wanted to become a huge security company where clients get passed through layers of sale
Why a Timelock Didn’t Prevent Term Finance’s $8.5M Exploit
On August 23, 2026, approximately $8.5 million was drained from Term Finance’s Ethereum vaults despite the protocol having a seven-day timelock. This was not a conventional exploit involving reentrancy, oracle manipulation, flash loans or compromised private keys. The attacker abused Term Finance’s
Q2 2026 Web3 Exploit Report
How Protocols Got Drained The second quarter of 2026 was the most damaging quarter in Web3 security this year. CD Security tracked every protocol-level exploit across April, May, and June — no scams, no phishing, no rug pulls. Just the technical failures that drained real funds from real protocols.
Q1 2026 Web3 Exploit Report
No scams. No phishing. No rugpulls. Only the technical failures -code logic, key/wallet compromise, infrastructure.
Inside CD Security's Audit Methodology: How We Secure 100+ Protocols
Most security firms treat their audit process like a trade secret. We think that's backwards. Here's exactly how we work—because you deserve to know what you're paying for.
How to Actually Prepare Your Web3 Project for Security Audits
A compact, practical guide covering security layers, auditor-ready code, pre-audit preparation, incident response, and emergency options for Web3 projects.
How to go from 0 to a paid Web3 auditor in 1 year
A realistic, no-BS roadmap for becoming a paid Web3 security auditor in about one year—what to accept upfront, how the job really works, and how to build real proof of skill.
What Happens When a Web3 Protocol Gets Hacked? Real Cases + Prevention Tips
An in-depth look at how major Web3 protocols responded to billion-dollar hacks, the five main post-exploit outcomes, and essential prevention strategies for teams.
Top 5 Smart Contract Security Bugs (Feb 2025): Solidity Front-Running, TypeScript DoS, and More
A technical breakdown of five critical vulnerabilities found across Solidity and TypeScript projects — from incorrect revert handling and front-running exploits to API DoS misconfigurations.
Top 5 Smart Contract Security Bugs (Jan 2025): Issues in Protocols Interacting with Uniswap V3 Liquidity & Cross-Chain Swaps
Five key vulnerabilities discovered across protocols using Uniswap V3 liquidity and cross-chain swaps — from missing withdrawal functions and allocation misconfigurations to slippage and reward handling issues.
Top 10 DeFi Projects to Watch in 2025: A Quick Guide to Stay Ahead in Crypto
A fast, developer-friendly rundown of 10 standout DeFi protocols in 2025—what they do, why they matter, how they work, and how they make money.