~/blog/defi
DeFi Audit Field Guides
Technical DeFi audit field guides covering lending, perpetuals, stablecoins, staking, prediction markets, and cross-chain accounting.
Beyond the Bet: Auditing a Prediction Market on Sui Move
A month of generalized field notes from a private Sui Move prediction-market review: pricing, signed oracles, settlement, NAV, LP queues, PTB composition, and why the dangerous bugs live between components.
read the field notesBetween Two Chains: How I Audit Cross-Chain DeFi Protocols
Lessons from a private engagement with Three Sigma: modeling asynchronous bridge state, mirrored accounting, stale snapshots, message ordering, recovery paths, and the gaps where cross-chain bugs actually live.
read the field guideWhen Collateral Is a Live Market: Auditing Lending Protocols on Bittensor
Lessons from a private engagement with BurraSec: unit-safe accounting, Dynamic TAO pricing, staking precompiles, lazy settlement, liquidation liveness, and runtime-aware testing.
read the field guideHow to Audit a Perp Protocol on Sui Move
Auditing perps on Sui requires a different checklist from EVM or Aptos. The object model, hot-potato request/response pattern, Programmable Transaction Blocks, and shared collateral vaults all reshape the attack surface — the Sui companion to the Aptos perp audit post.
read moreHow to Audit Aave V3 Fork Deployment Scripts
Learnings from auditing Aave V3 fork deployment scripts — the bug classes, the patterns, and the real findings from production audits.
read moreHow to Audit a Lending Protocol on Sui Move
Share-ratio manipulation, eMode edge cases, oracle staleness, and the liquidation paths that actually break — a field checklist from a live Sui lending audit.
read moreFormal Verification of Current Sui Using Certora — Part 2
Using Certora's Sui Prover to encode borrow restrictions as parametric rules — and what the prover surfaced that manual review walked past.
read moreFormal Verification of Current Sui Using Certora Sui Prover
How I mathematically proved that an eMode group assignment is immutable after obligation creation in a Sui DeFi lending protocol — using Certora's Sui Prover, parametric rules, and field accessors.
read moreHow to Audit a Gold-Backed Staking Protocol on Solana
RWA-backed staking on Solana: mint/redeem trust boundaries, reward accounting, oracle dependencies, and the Anchor account-validation traps from a real engagement.
read moreHow to Audit a Stablecoin Protocol
Peg mechanics, collateral accounting, mint/burn access paths, and diamond-pattern upgrade risk — what I check first in every stablecoin review.
read moreAuditing a Perp Protocol on Aptos Move
Learnings from auditing a fully on-chain perp DEX in Move on Aptos — orderbook mechanics, oracle integration, liquidation engine, funding rate, and the bugs that actually matter.
read moreThe Move Bug That Would Have Bricked Aave on Aptos Before Day One
A case study from Aave Aptos V3 on Cantina, where Panther placed 3rd with 1 confirmed High and 1 confirmed Medium. The High came down to data being stored at one address and read from another.
read more