FINANCIAL LOGIC SECURITY · RESEARCH & DOCUMENTATION
The bugs that drain accounts don't look like the bugs your scanner already finds.
Broken authorization, double-spend races, settlement bypass, and other business-logic vulnerabilities live in plain sight - past where injection and XSS scanners stop looking. This is where we write about that gap, and document the tool we built to close it.
LATEST POSTS
Feb 24, 2026
Beyond Reentrancy: Smart Contract Risks That Can Escape Traditional Reviews
Reentrancy deserves the attention it gets, but settlement bypasses, oracle manipulation, broken access control, and unchecked external calls continue to create serious security risks in production smart contracts.
Feb 3, 2026
How to Detect Double-Spend Race Conditions in Node.js Before They Ship
The check-then-act pattern that allows concurrent requests to spend the same balance twice, and how to identify it before it reaches production.
Jan 12, 2026
Business Logic Vulnerabilities vs the OWASP Top 10: Why Generic Security Scanners Can Miss Them
SQL injection and XSS follow recognizable patterns. Business logic vulnerabilities emerge from how an application behaves-and that requires a different way of thinking about security.