# Publications from Trail of Bits - [Publications from Trail of Bits](#publications-from-trail-of-bits) - [Academic Papers](#academic-papers) - [White Papers](#white-papers) - [Guides and Handbooks](#guides-and-handbooks) - [Conference Presentations](#conference-presentations) - [Automated bug finding and exploitation](#automated-bug-finding-and-exploitation) - [Blockchain](#blockchain) - [Compilers](#compilers) - [Cryptography](#cryptography) - [Engineering](#engineering) - [Education](#education) - [Infrastructure](#infrastructure) - [Machine Learning](#machine-learning) - [Mobile security](#mobile-security) - [Programming](#programming) - [Side channels](#side-channels) - [Supply chain](#supply-chain) - [Threat analysis \& malware](#threat-analysis--malware) - [Podcasts](#podcasts) - [Webinars](#webinars) - [Public Comments](#public-comments) - [Case Studies](#case-studies) - [Security Reviews](#security-reviews) - [Major Clients](#major-clients) - [Frax Finance](#frax-finance) - [MobileCoin](#mobilecoin) - [Offchain Labs](#offchain-labs) - [Reserve Protocol](#reserve-protocol) - [Scroll](#scroll) - [Uniswap](#uniswap) - [Western Digital](#western-digital) - [AI/ML Reviews](#aiml-reviews) - [Cryptography Reviews](#cryptography-reviews) - [Technology Product Reviews](#technology-product-reviews) - [Cloud-Native Reviews](#cloud-native-reviews) - [Invariant Testing and Development Engagements](#invariant-testing-and-development-engagements) - [Blockchain Reviews](#blockchain-reviews) - [Wallet Reviews](#wallet-reviews) - [Algorand](#algorand) - [Avalanche](#avalanche) - [Bitcoin \& Derivatives](#bitcoin--derivatives) - [Ethereum/EVM](#ethereumevm) - [NervOS](#nervos) - [Starknet](#starknet) - [Solana](#solana) - [Substrate](#substrate) - [Tendermint/Cosmos](#tendermintcosmos) - [Tezos](#tezos) - [TON](#ton) - [Other/Multi-Chain](#othermulti-chain) - [Disclosures and exploits](#disclosures-and-exploits) - [Workshops](#workshops) - [Datasets](#datasets) - [Service Overviews](#service-overviews) - [Legend](#legend) ## Academic Papers | Paper Title | Venue | Publication Date | | --- | --- | --- | | [A Broad Comparative Evaluation of Software Debloating Tools](https://github.com/trailofbits/publications/blob/master/papers/debloater-eval.pdf) | [USENIX Security 2024](https://www.usenix.org/conference/usenixsecurity24) | 2024 | | [PolyTracker: Whole-Input Dynamic Information Flow Tracing](https://github.com/trailofbits/publications/blob/master/papers/issta24-polytracker.pdf) | [ISSTA 2024](https://conf.researchr.org/details/issta-ecoop-2024/issta-ecoop-2024-tool-demonstrations/7/PolyTracker-Whole-Input-Dynamic-Information-Flow-Tracing) | 2024 | | [Endokernel: A Thread Safe Monitor for Lightweight Subprocess Isolation](https://github.com/trailofbits/publications/blob/master/papers/usenixsecurity24-endokernel.pdf) | [Usenix Security 2024](https://www.usenix.org/conference/usenixsecurity24/presentation/yang-fangfei) | 2024 | | [Design and Implementation of a Coverage-Guided Ruby Fuzzer](https://github.com/trailofbits/publications/blob/master/papers/ruzzy-ruby-fuzzer.pdf) | [CSET 24](https://cset24.isi.edu/) | 2024 | | [Test Harness Mutilation](https://github.com/trailofbits/publications/blob/master/papers/test_harness_mutilation.pdf) | [Mutation 2024](https://conf.researchr.org/home/icst-2024/mutation-2024) | 2024 | | [VAST: MLIR compiler for C/C++](https://github.com/trailofbits/publications/blob/master/papers/vast-eurollvm-poster.pdf) | [EuroLLVM Devs' Meeting 2024](https://llvm.swoogo.com/2024eurollvm) | 2024 | | [PoTATo: Points-to analysis via domain specific MLIR dialect](https://github.com/trailofbits/publications/blob/master/papers/potato-eurollvm-poster.pdf) | [EuroLLVM Devs' Meeting 2024](https://llvm.swoogo.com/2024eurollvm) | 2024 | | [Careful with MAc-then-SIGn: A Computational Analysis of the EDHOC Lightweight Authenticated Key Exchange Protocol](https://github.com/trailofbits/publications/blob/master/papers/edhoc-euros%26P-2023.pdf) | [Euro S&P 2023](https://www.ieee-security.org/TC/EuroSP2023/index.html) | 2023 | | [Weak Fiat-Shamir Attacks on Modern Proof Systems](https://github.com/trailofbits/publications/blob/master/papers/weakfs_ieee_s%26p_2023.pdf) | [IEEE S&P 2023](https://eprint.iacr.org/2023/691) | 2023 | | [Endoprocess: Programmable and Extensible Subprocess Isolation](https://dl.acm.org/doi/10.1145/3633500.3633507) | [NSPW 2023](https://www.nspw.org/2023/program) | 2023 | | [CIVSCOPE: Analyzing Potential Memory Corruption Bugs in Compartment Interfaces](https://github.com/trailofbits/publications/blob/master/papers/civscope.pdf) | SOSP [KISV 2023](https://dl.acm.org/doi/abs/10.1145/3625275.3625399) | 2023 | | [Detecting variability bugs through hybrid control and data flow analysis](https://github.com/trailofbits/publications/blob/master/papers/ubet_langsec_2023.pdf) | [LangSec 2023](https://langsec.org/spw23/papers.html#variability) | 2023 | | [Blind Spots: Automatically detecting ignored program inputs](https://arxiv.org/abs/2301.08700) | [LangSec 2023](https://langsec.org/spw23/papers.html) | 2023 | | [Efficient Proofs of Software Exploitability for Real-world Processors](https://github.com/trailofbits/publications/blob/master/papers/sieve-msp430-pets2023.pdf) | [PETS 2023](https://petsymposium.org/2023/index.php) | 2023 | | [Toward Comprehensive Risk Assessments and Assurance of AI Systems](https://github.com/trailofbits/publications/blob/master/papers/toward_comprehensive_risk_assessments.pdf) | arXiv | 2023 | | [A Broad Comparative Evaluation of x86-64 Binary Rewriters](https://github.com/trailofbits/publications/blob/master/papers/cset22.pdf) | [CSET 22](https://cset22.isi.edu/index.html) | 2022 | | [On the Optimization of Equivalent Concurrent Computations](https://github.com/trailofbits/publications/blob/master/papers/eqsat-pldi-egraphs2022.pdf) | [PLDI EGRAPHS 2022](https://pldi22.sigplan.org/program/program-egraphs-2022/) | 2022 | | [Evaluating Static Analysis Tools via Differential Mutation](https://github.com/trailofbits/publications/blob/master/papers/qrs21.pdf) | [QRS 2021](https://qrs21.techconf.org/) | 2021 | | [echidna-parade: Diverse multicore smart contract fuzzing](https://github.com/trailofbits/publications/blob/master/papers/echidna-parade_issta21.pdf) | [ISSTA 2021](https://conf.researchr.org/home/issta-2021) | 2021 | | [Differential analysis of x86-64 instruction decoders](https://github.com/trailofbits/publications/blob/master/papers/mishegos-langsec2021.pdf) | [LangSec 2021](https://langsec.org/spw21/) | 2021 | | [Echidna: effective, usable, and fast fuzzing for smart contracts](https://github.com/trailofbits/publications/blob/master/papers/echidna_issta2020.pdf) | [ISSTA 2020](https://conf.researchr.org/home/issta-2020) | 2020 | | [ICARUS: Understanding De Facto Formats By Way of Feathers and Wax](https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=9283834) | [LangSec 2020](http://spw20.langsec.org/) | 2020 | | [Toward Automated Grammar Extraction via Semantic Labeling of Parser Implementations](https://github.com/trailofbits/publications/blob/master/papers/semantic_labeling_langsec2020.pdf) | [LangSec 2020](http://spw20.langsec.org/) | 2020 | | [What are the Actual Flaws in Important Smart Contracts?](https://github.com/trailofbits/publications/blob/master/papers/smart_contract_flaws_fc2020.pdf) | [FC 2020](https://fc20.ifca.ai/program.html) | 2020 | | [Echidna: A Practical Smart Contract Fuzzer](https://github.com/trailofbits/publications/blob/master/papers/echidna_fc_poster.pdf) | [FC 2020](https://fc20.ifca.ai/program.html) | 2020 | | [RSA GTFO](https://github.com/trailofbits/publications/blob/master/papers/rsagtfo.pdf) | [PoC\|\|GTFO 0x20](https://www.sultanik.com/pocorgtfo/#0x20) | 2020 | | [Manticore: Symbolic Execution for Binaries and Smart Contracts](https://github.com/trailofbits/publications/blob/master/papers/manticore.pdf) | [ASE 2019](https://2019.ase-conferences.org/) | 2019 | | [Slither: A Static Analysis Framework For Smart Contracts](https://github.com/trailofbits/publications/blob/master/papers/wetseb19.pdf) | [WETSEB 2019](http://www.agilegroup.eu/wetseb2019/) | 2019 | | [Toward Smarter Vulnerability Discovery Using Machine Learning](https://github.com/trailofbits/publications/blob/master/papers/ceo.pdf) | [AISec 2018](http://aisec2018.icsi.berkeley.edu/aisec2018/index.html) | 2018 | | [The Past, Present, and Future of Cyberdyne](https://github.com/trailofbits/publications/blob/master/papers/cyberdyne.pdf) | [IEEE S&P](https://ieeexplore.ieee.org/xpl/tocresult.jsp?isnumber=8328963) | 2018 | | [DeepState - Symbolic Unit Testing for C and C++](https://github.com/trailofbits/publications/blob/master/papers/deepstate-bar18.pdf) | [BAR 2018](https://www.ndss-symposium.org/ndss2018/cfp-ndss2018-bar/) | 2018 | | [Cyber-Deception and Attribution in Capture-the-Flag Exercises](https://github.com/trailofbits/publications/blob/master/papers/deception_attribution_ctf.pdf) | [FOSINT-SI 2015](http://fosint-si.cpsc.ucalgary.ca/2015/) | 2015 | ## White Papers | Paper Title | Author(s) | Publication Date | | --- | --- | --- | | [Detecting Implicit Conversions in OpenVPN2 Using CodeQL](https://github.com/trailofbits/publications/blob/master/reports/detecting-implicit-conversions-in-openvpn2-using-codeql-casestudy.pdf) | Paweł Płatek | Sep 2025 | | [Preventing Account Takeovers on Centralized Cryptocurrency Exchanges Recommended Practices](https://github.com/trailofbits/publications/blob/master/papers/account-takeover-recommended-practices.pdf) | Shaun Mirani, Kelly Kaoudis, and Evan Sultanik | Feb 2025 | | [Input-Driven Recursion: Ongoing Security Risks](https://github.com/trailofbits/publications/blob/master/papers/trailofbits-20241218-recursion-whitepaper.pdf) | Alexis Challande and Brad Swain | Dec 2024 | | [OpenSearch Benchmark Assessment](https://github.com/trailofbits/publications/blob/master/reports/OpenSearch-Benchmarking.pdf) | Evan Downing, Riccardo Schirone, Francesco Bertolaccini, and Ronald Eytchison | Aug 2024 | | [Cedar, Rego, and OpenFGA Policy Languages: Comparative Language Security Assessment](https://github.com/trailofbits/publications/blob/master/reports/Policy_Language_Security_Comparison_and_TM.pdf) | Ian Smith and Kelly Kaoudis | Aug 2024 | | [Toward Comprehensive Risk Assessments and Assurance of AI-Based Systems](https://github.com/trailofbits/publications/blob/master/papers/trailofbits-20230307-ai-risk-assessments-whitepaper.pdf) | Heidy Khlaaf | Mar 2023 | | [Are Blockchains Decentralized? Unintended Centralities in Distributed Ledgers](https://github.com/trailofbits/publications/blob/master/papers/trailofbits-20220601-are-blockchain-decentralized-whitepaper.pdf) | Evan Sultanik et al. | Jun 2022 | | [Do You Really Need a Blockchain? An Operational Risk Assessment](https://github.com/trailofbits/publications/blob/master/papers/trailofbits-20220601-do-you-really-need-a-blockchain-whitepaper.pdf) | Evan Sultanik and Mike Myers | Jun 2022 | ## Guides and Handbooks | Link | Description | | ---- | ----------- | | [Testing Handbook](https://appsec.guide/) | Guides for configuring and automating static and dynamic analysis tools | | [ZKDocs](https://www.zkdocs.com/) | Interactive documentation on zero-knowledge proof systems | | [Building Secure Smart Contracts](https://secure-contracts.com/) | Best practices for developing secure smart contracts | | [CTF Field Guide](https://trailofbits.github.io/ctf/) | Field guide to winning at Capture The Flag competitions | | [Ruby Security Field Guide](https://trailofbits.github.io/rubysec/) | Practical Ruby security guide | ## Conference Presentations ### Automated bug finding and exploitation | Presentation Title | Author(s) | Year | | --- |---------------------------------------------------| --- | | [Finding Hidden Overflows in Go: Fuzzing Beyond the Compiler's Limits](https://github.com/trailofbits/publications/blob/master/presentations/Finding%20Hidden%20Overflows%20in%20Go%3A%20Fuzzing%20Beyond%20the%20Compiler%27s%20Limits) | Kevin Valerio | 2026 | | [Buttercup: Autonomously Finding and Fixing Bugs at Scale in Open-Source Software](https://github.com/trailofbits/publications/blob/master/presentations/Buttercup%3A%20Autonomously%20Finding%20and%20Fixing%20Bugs%20at%20Scale%20in%20Open-Source%20Software/buttercup-cucyber.pdf) | Ronald Eytchison | 2025 | | [Buttercup: The Future of Trail of Bits' Solution to DARPA's AI Cyber Challenge](https://github.com/trailofbits/publications/blob/master/presentations/Buttercup%3A%20The%20Future%20of%20Trail%20of%20Bits%27%20Solution%20to%20DARPA%27s%20AI%20Cyber%20Challenge) | Trent Brunson | 2025 | | [Buttercup and DARPA's AI Cyber Challenge, Ringzer0](https://github.com/trailofbits/publications/blob/master/presentations/Buttercup%20and%20DARPA%27s%20AI%20Cyber%20Challenge%2C%20Henrik%20Brodin%20and%20Ronald%20Eytchison) | Henrik Brodin, Ronald Eytchison | 2025 | | [Our experience competing in the AI Cyber Challenge](https://github.com/trailofbits/publications/blob/master/presentations/Our%20experience%20competing%20in%20the%20AI%20Cyber%20Challenge/Our_experience_competing_in_the_AI_Cyber_Challenge.pdf) | Michael Brown et al. | 2025 | | [Buttercup and DARPA's AI Cyber Challenge, CSAW](https://github.com/trailofbits/publications/blob/master/presentations/Buttercup%20and%20DARPA%27s%20AI%20Cyber%20Challenge%2C%20Ronald%20Eytchison) | Ronald Eytchison | 2024 | | [Your Mitigations are My Opportunities](https://github.com/trailofbits/publications/blob/master/presentations/Your%20Mitigations%20are%20My%20Opportunities) | Yarden Shafir | 2023 | | [Detecting variability bugs with hybrid control and data flow](https://github.com/trailofbits/publications/blob/master/presentations/Automatically%20Detecting%20Variability%20Bugs%20Through%20Hybrid%20Control%20and%20Data%20Flow%20Analysis) | Kelly Kaoudis, Henrik Brodin, Evan Sultanik | 2023 | | Blind Spots: Identifying Exploitable Program Inputs | Henrik Brodin, Evan Sultanik, and Marek Surovič | 2023 | | [MLIR is the future of program analysis](https://github.com/trailofbits/publications/blob/master/presentations/MLIR%20is%20the%20future%20of%20program%20analysis) | Peter Goodman | 2023 | | [A Sermon on the Indulgences of Computational Sacrifice; or, The Superabundant Benedictions of Programming an Absurd NES Game](https://www.youtube.com/watch?v=RTjP3fnQ5d8) | Evan Sultanik | 2021 | | [Differential analysis of x86-64 instruction decoders](https://github.com/trailofbits/publications/blob/master/presentations/Differential%20analysis%20of%20x86-64%20decoders) | William Woodruff, Niki Carroll, Sebastiaan Peters | 2021 | | [How to find bugs when (ground) truth isn't real](https://github.com/trailofbits/publications/blob/master/presentations/Differential%20fuzzing%2C%20or%20how%20to%20find%20bugs%20when%20%28ground%29%20truth%20isn%27t%20real) | William Woodruff | 2020 | | [Toward Automated Grammar Extraction via Semantic Labeling of Parser Implementations](https://github.com/trailofbits/publications/blob/master/presentations/Semantic%20Labeling%20of%20Parsers) | Carson Harmon, Brad Larsen, Evan Sultanik | 2020 | | [The Treachery of Files and Two New Tools that Tame It](https://github.com/trailofbits/publications/blob/master/presentations/The%20Treachery%20of%20Files) | Evan Sultanik | 2019 | | [Symbolically Executing a Fuzzy Tyrant](https://github.com/trailofbits/publications/blob/master/presentations/Symbolically%20Executing%20a%20Fuzzy%20Tyrant) | Stefan Edwards | 2019 | | [Kernel space fault injection with KRF](https://github.com/trailofbits/publications/blob/master/presentations/Kernel%20space%20fault%20injection%20with%20KRF) | William Woodruff | 2019 | | [Binary Symbolic Execution With KLEE-Native](https://github.com/trailofbits/publications/blob/master/presentations/Binary%20Symbolic%20Execution%20With%20KLEE-Native) | Sai Vegasena | 2019 | | [Going sicko mode on the Linux Kernel](https://github.com/trailofbits/publications/blob/master/presentations/Going%20sicko%20mode%20on%20the%20Linux%20Kernel) | William Woodruff | 2019 | | [Vulnerability Modeling with Binary Ninja](https://github.com/trailofbits/publications/blob/master/presentations/Vulnerability%20Modeling%20with%20Binary%20Ninja) | Josh Watson | 2018 | | [File Polyglottery; or, This PoC is also a picture of cats](https://github.com/trailofbits/publications/blob/master/presentations/The%20Treachery%20of%20Files) | Evan Sultanik | 2017 | | [Be a binary rockstar](https://vimeo.com/215511922#t=27m33s) | Sophia D'Antoine | 2017 | | [Symbolic Execution for Humans](https://github.com/trailofbits/publications/blob/master/presentations/Symbolic%20Execution%20for%20Humans) | Mark Mossberg | 2017 | | [The spirit of the 90s is still alive in Brooklyn](https://github.com/trailofbits/publications/blob/master/presentations/The%20spirit%20of%20the%2090s%20is%20alive%20in%20Brooklyn) | Ryan Stortz, Sophia D'Antoine | 2017 | | [The dream of a static and dynamic analysis shootout](https://github.com/trailofbits/publications/blob/master/presentations/The%20dream%20of%20a%20static%20and%20dynamic%20analysis%20shootout) | Ryan Stortz | 2016 | | [Binary constraint solving for automatic exploit generation](https://github.com/trailofbits/publications/blob/master/presentations/Binary%20constraint%20solving%20for%20automatic%20exploit%20generation) | Sophia D'Antoine | 2016 | | [The Smart Fuzzer Revolution](https://github.com/trailofbits/publications/blob/master/presentations/The%20Smart%20Fuzzer%20Revolution) | Dan Guido | 2016 | | [Making a scaleable automated hacking system](https://github.com/trailofbits/publications/blob/master/presentations/Cyber%20Grand%20Challenge) | Artem Dinaburg | 2016 | | [Cyberdyne - Automatic bug-finding at scale](https://github.com/trailofbits/publications/blob/master/presentations/Cyber%20Grand%20Challenge) | Peter Goodman | 2016 | | [McSema: Static translation of x86 to LLVM IR](https://github.com/trailofbits/publications/blob/master/presentations/McSema%20-%20Static%20Translation%20of%20x86%20instructions%20to%20LLVM%20IR) | Andrew Ruef, Artem Dinaburg | 2014 | ### Blockchain | Presentation Title | Author(s) | Year | | --- | --- | --- | | [Mutation Testing with Slither: A New Way to Find High-Severity Issues](https://github.com/trailofbits/publications/blob/master/presentations/Mutation%20Testing%20with%20Slither%3A%20A%20New%20Way%20to%20Find%20High-Severity%20Issues) | Guillermo Larregay | 2025 | | [Slither's Model Context Protocol: Giving LLMs Ground Truth from Static Analysis](https://github.com/trailofbits/publications/blob/master/presentations/Slither%27s%20Model%20Context%20Protocol%3A%20Giving%20LLMs%20Ground%20Truth%20from%20Static%20Analysis) | Ben Samuels | 2025 | | [The $1.5B Problem: How Exchanges Can Build Safer Cold Storage](https://github.com/trailofbits/publications/blob/master/presentations/The%20%241.5B%20Problem%3A%20How%20Exchanges%20Can%20Build%20Safer%20Cold%20Storage) | Benjamin Samuels | 2025 | | [How to Become a Smart Contract Auditor](https://github.com/trailofbits/publications/blob/master/presentations/How%20to%20Become%20a%20Smart%20Contract%20Auditor) | nisedo | 2025 | | [Test your tests: the do's and don'ts of testing](https://github.com/trailofbits/publications/blob/master/presentations/TrustX%202023/Test%20Your%20Tests) | Kurt Willis | 2023 | | [Slither: a static analysis tool for Vyper and Solidity](https://github.com/trailofbits/publications/blob/master/presentations/TrustX%202023/Slither%20a%20Vyper%20and%20Solidity%20static%20analyzer) | Troy Sargent | 2023 | | [Roundme: rounding analysis made simpler](https://github.com/trailofbits/publications/blob/master/presentations/TrustX%202023/roundme) | Josselin Feist | 2023 | | [Smart Contracts: The Beta](https://github.com/trailofbits/publications/blob/master/presentations/Smart%20Contracts%3A%20The%20Beta/DSS%20101.pdf) | Nat Chin | 2023 | | [Fuzzing like a security engineer](https://github.com/trailofbits/publications/blob/master/presentations/How%20to%20Fuzz%20Like%20a%20Pro/Eth%20Taipei%20Workshop.pdf) | Nat Chin | 2023 | | [Write better smart contracts with Slither's Python API](https://github.com/trailofbits/publications/blob/master/presentations/Write%20Better%20Smart%20Contracts%20By%20Checking%20Them%20With%20Slither%27s%20Python%20API) | Troy Sargent | 2022 | | [Building Secure Cairo](https://github.com/trailofbits/publications/blob/master/presentations/Building%20Secure%20Cairo) | Filipe Casal, Simone Monica | 2022 | | [How to fuzz like a pro](https://github.com/trailofbits/publications/blob/master/presentations/How%20to%20Fuzz%20Like%20a%20Pro) | Josselin Feist, Nat Chin | 2022 | | [Demystifying Fuzzing](https://github.com/trailofbits/publications/blob/master/presentations/Demystifying%20Fuzzing) | Nat Chin | 2022 | | [Building a Practical Static Analyzer for Smart Contracts](https://github.com/trailofbits/publications/blob/master/presentations/Building%20a%20Practical%20Static%20Analyzer%20for%20Smart%20Contracts) | Josselin Feist | 2021 | | [Testing and Verifying Smart Contracts: From Theory to Practice](https://github.com/trailofbits/publications/blob/master/presentations/Testing%20and%20Verifying%20Smart%20Contracts%3A%20From%20Theory%20to%20Practice) | Josselin Feist | 2021 | | [Safely integrating with ERC20 tokens](https://github.com/trailofbits/publications/blob/master/presentations/Safely%20integrating%20with%20ERC20%20tokens) | Josselin Feist | 2021 | | [Detecting transaction replacement attacks with Manticore](https://github.com/trailofbits/publications/blob/master/presentations/Detecting%20transaction%20replacement%20attacks%20with%20Manticore) | Sam Moelius | 2020 | | [DeFi Hacks and Future Threats: The Role of Economics in Secure Protocol Design](https://github.com/trailofbits/publications/blob/master/presentations/DeFi%20Hacks%20and%20Future%20Threats) | Dan Guido | 2020 | | [Fantastic Bugs and How to Squash Them; or, the Crimes of Solidity](https://github.com/trailofbits/publications/blob/master/presentations/Anatomy%20of%20an%20unsafe%20programming%20language) | Evan Sultanik | 2019 | | [SlithIR: High-Precision Security Analysis with an IR for Solidity](https://github.com/trailofbits/publications/blob/master/presentations/SlithIR%2C%20An%20Intermediate%20Representation%20of%20Solidity%20to%20enable%20High%20Precision%20Security%20Analysis) | Josselin Feist | 2019 | | [Slither: A Static Analysis Framework for Smart Contracts](https://github.com/trailofbits/publications/blob/master/presentations/Slither%3A%20A%20Static%20Analysis%20Framework%20for%20Smart%20Contracts) | Josselin Feist | 2019 | | [What blockchain got right](https://github.com/trailofbits/publications/blob/master/presentations/What%20blockchain%20got%20right) | Dan Guido | 2019 | | [Traditional Infosec for Blockchain Firms](https://github.com/trailofbits/publications/blob/master/presentations/Traditional%20Infosec%20for%20Blockchain%20Firms) | Dan Guido | 2019 | | [Property-testing of smart contracts](https://github.com/trailofbits/publications/blob/master/presentations/Property-based%20testing%20of%20smart%20contracts) | JP Smith | 2018 | | [Anatomy of an unsafe programming language](https://github.com/trailofbits/publications/blob/master/presentations/Anatomy%20of%20an%20unsafe%20programming%20language) | Evan Sultanik | 2018 | | [Contract upgrade risks and recommendations](https://github.com/trailofbits/publications/blob/master/presentations/Contract%20upgrade%20risks%20and%20recommendations) | Josselin Feist | 2018 | | [Blackhat Ethereum](https://github.com/trailofbits/publications/blob/master/presentations/Blackhat%20Ethereum) | Ryan Stortz, Jay Little | 2018 | | [Blockchain Autopsies - Analyzing Smart Contract Deaths](https://github.com/trailofbits/publications/blob/master/presentations/Blockchain%20Autopsies%20-%20Analyzing%20Smart%20Contract%20Deaths) | Jay Little | 2018 | | [Rattle - an Ethereum EVM binary analysis framework](https://github.com/trailofbits/publications/blob/master/presentations/Rattle%20-%20an%20Ethereum%20EVM%20binary%20analysis%20framework) | Ryan Stortz | 2018 | | [Securing value on the Ethereum blockchain](https://github.com/trailofbits/publications/blob/master/presentations/Securing%20value%20on%20the%20Ethereum%20blockchain) | Dan Guido | 2018 | | [Binary analysis, meet the blockchain](https://github.com/trailofbits/publications/blob/master/presentations/Binary%20analysis%2C%20meet%20the%20blockchain) | Mark Mossberg | 2018 | | [Automatic bug finding for the blockchain](https://github.com/trailofbits/publications/blob/master/presentations/Automatic%20bugfinding%20for%20the%20blockchain) | Felipe Manzano, Josselin Feist | 2017 | ### Compilers | Presentation Title | Author(s) | Year | | --- | --- | --- | | [Constant-Time Coding Support in LLVM](https://github.com/trailofbits/publications/blob/master/presentations/Constant-Time%20Coding%20Support%20in%20LLVM) | Julius Alexandre | 2025 | | [A Broad Comparative Evaluation of Software Debloating Tools](https://github.com/trailofbits/publications/blob/master/presentations/A%20Broad%20Comparative%20Evaluation%20of%20Software%20Debloating%20Tools/debloater-eval.pdf) | Michael D. Brown, Adam Meily, Eric Kilmer, Ronald Eytchison | 2024 | | [Repurposing LLVM analyses in MLIR: Also there and back again across the tower of IRs](https://github.com/trailofbits/publications/blob/master/presentations/Repurposing%20LLVM%20analyses%20in%20MLIR%3A%20Also%20there%20and%20back%20again%20across%20the%20Tower%20of%20IRs) | Henrich Lauko | 2024 | | [VAST: MLIR for program analysis of C/C++](https://github.com/trailofbits/publications/blob/master/presentations/VAST%3A%20MLIR%20for%20program%20analysis%20of%20C) | Henrich Lauko | 2022 | | [A Broad Comparative Evaluation of x86-64 Binary Rewriters](https://github.com/trailofbits/publications/blob/master/presentations/A%20Broad%20Comparative%20Evaluation%20of%20x86-64%20Binary%20Rewriters/A%20Broad%20Comparative%20Evaluation%20of%20x86-64%20Binary%20Rewriters.pdf) | Michael D. Brown | 2022 | | [On the Optimization of Equivalent Concurrent Computations](https://github.com/trailofbits/publications/blob/master/presentations/On%20the%20Optimization%20of%20Equivalent%20Concurrent%20Computations/PLDI-EGRAPHS-2022.pdf) | Henrich Lauko, Lukáš Korenčik, Peter Goodman | 2022 | ### Cryptography | Presentation Title | Author(s) | Year | | --- | --- | --- | | [Cut To The QUIC: Slashing QUIC's Performance With A Hash DoS](https://github.com/trailofbits/publications/blob/master/presentations/Cut%20To%20The%20QUIC%3A%20Slashing%20QUIC%27s%20Performance%20With%20A%20Hash%20DoS) | Paul Bottinelli | 2025 | | [One, Two, TEE: Trust in Numbers Meets Hardware Security](https://github.com/trailofbits/publications/blob/master/presentations/One%2C%20Two%2C%20TEE%3A%20Trust%20in%20Numbers%20Meets%20Hardware%20Security) | Paul Bottinelli | 2025 | | [Weak Fiat-Shamir attacks on modern proof systems](https://github.com/trailofbits/publications/blob/master/presentations/Weak%20Fiat-Shamir%20attacks%20on%20modern%20proof%20systems) | Jim Miller | 2024 | | [Building a Rusty path validation library for PyCA Cryptography](https://github.com/trailofbits/publications/blob/master/presentations/Building%20a%20Rusty%20path%20validation%20library%20for%20PyCA%20Cryptography) | William Woodruff | 2024 | | [Implementing X.509 path validation for Python](https://github.com/trailofbits/publications/blob/master/presentations/Implementing%20X.509%20path%20validation%20for%20Python) | William Woodruff | 2024 | | [Careful with MAc-then-SIGn](https://github.com/trailofbits/publications/blob/master/presentations/Careful%20with%20MAc-then-SIGn/128_Careful_with_MAC_then_SIGn.pdf) | Marc Ilunga | 2023 | | [die, PGP, die](https://github.com/trailofbits/publications/blob/master/presentations/die%2C%20PGP%2C%20die) | William Woodruff | 2022 | | [Seriously, stop using RSA](https://github.com/trailofbits/publications/blob/master/presentations/Seriously%2C%20stop%20using%20RSA) | Ben Perez | 2019 | | [Best Practices for Cryptography in Python](https://github.com/trailofbits/publications/blob/master/presentations/Best%20Practices%20for%20Cryptography%20in%20Python) | Paul Kehrer | 2019 | | [Analyzing the MD5 collision in Flame](https://github.com/trailofbits/publications/blob/master/presentations/Analyzing%20the%20MD5%20Collision%20in%20Flame) | Alex Sotirov | 2012 | ### Engineering | Presentation Title | Author(s) | Year | | --- | --- | --- | | [Repeatable Benchmarking: An Exploration of OpenSearch vs Elasticsearch](https://github.com/trailofbits/publications/blob/master/presentations/Repeatable%20Benchmarking%3A%20An%20Exploration%20of%20OpenSearch%20vs%20Elasticsearch) | Evan Downing | 2025 | | [Evidence-driven Security Engineering](https://github.com/trailofbits/publications/blob/master/presentations/Evidence-driven%20Security%20Engineering) | Dan Guido | 2019 | | [Linux Security Event Monitoring with osquery](https://github.com/trailofbits/publications/blob/master/presentations/osquery%20Linux%20security%20event%20monitoring) | Alessandro Gario | 2019 | | [osql: The community oriented osquery fork](https://github.com/trailofbits/publications/blob/master/presentations/osql%3A%20The%20community%20oriented%20osquery%20fork) | Stefano Bonicatti, Mark Mossberg | 2019 | | [Getting started with osquery](https://github.com/trailofbits/publications/blob/master/presentations/Getting%20started%20with%20osquery) | Lauren Pearl, Andy Ying | 2018 | | [osquery Super Features](https://github.com/trailofbits/publications/blob/master/presentations/osquery%20Super%20Features) | Lauren Pearl | 2018 | | [osquery Extension Skunkworks](https://github.com/trailofbits/publications/blob/master/presentations/osquery%20Extension%20Skunkworks) | Mike Myers | 2018 | | [Build it Break it Fix it](https://github.com/trailofbits/publications/blob/master/presentations/Build%20it%20Break%20it%20Fix%20it) | Andrew Ruef | 2014 | ### Education | Presentation Title | Author(s) | Year | | --- | --- | --- | | [Introduction to Semgrep](https://github.com/trailofbits/publications/blob/master/presentations/Introduction%20To%20Semgrep/Testing%20Handbook%20-%20Semgrep.pdf) and
[Semgrep Practice Exercises](https://github.com/trailofbits/publications/blob/master/presentations/Introduction%20To%20Semgrep/TrailofBits_Semgrep_Practice_Exercises.pdf) | Maciej Domański, Matt Schwager, Spencer Michaels | 2024 | | [A mostly gentle introduction to LLVM](https://github.com/trailofbits/publications/blob/master/presentations/A%20mostly%20gentle%20introduction%20to%20LLVM) | William Woodruff | 2022 | | [JWTs, and why they suck](https://github.com/trailofbits/publications/blob/master/presentations/JWTs%2C%20and%20why%20they%20suck) | Rory M | 2021 | | [The Joy of Pwning](https://github.com/trailofbits/publications/blob/master/presentations/The%20Joy%20of%20Pwning) | Sophia D'Antoine | 2017 | | [How to CTF - Getting and using Other People's Computers (OPC)](https://github.com/trailofbits/publications/blob/master/presentations/How%20to%20CTF%20-%20Getting%20and%20Using%20OPC) | Jay Little | 2014 | | [Low-level Security](https://github.com/trailofbits/publications/blob/master/presentations/Low-level%20Security) | Andrew Ruef | 2014 | | [Security and Your Business](https://github.com/trailofbits/publications/blob/master/presentations/Security%20and%20Your%20Business) | Andrew Ruef | 2014 | | [Bringing nothing to the party](https://github.com/trailofbits/publications/blob/master/presentations/Bringing%20nothing%20to%20the%20party) | Vincenzo Iozzo | 2013 | | [From One Ivory Tower to Another](https://github.com/trailofbits/publications/blob/master/presentations/From%20One%20Ivory%20Tower%20to%20Another) | Vincenzo Iozzo | 2012 | ### Infrastructure | Presentation Title | Author(s) | Year | | --- | --- | --- | | [Return to the 100 Acre Woods](https://github.com/trailofbits/publications/blob/master/presentations/Return%20to%20the%20100%20Acre%20Woods) | Stefan Edwards | 2019 | | [Swimming with the kubectl fish](https://github.com/trailofbits/publications/blob/master/presentations/Swimming%20with%20the%20kubectl%20fish) | Stefan Edwards | 2019 | ### Machine Learning | Presentation Title | Author(s) | Year | | --- | --- | --- | | [How we made Trail of Bits AI-Native (so far)](https://github.com/trailofbits/publications/blob/master/presentations/How%20we%20made%20Trail%20of%20Bits%20AI-Native%20%28so%20far%29) | Dan Guido | 2026 | | [Weaponizing Image Scaling Against Production AI Systems](https://github.com/trailofbits/publications/blob/master/presentations/Weaponizing%20Image%20Scaling%20Against%20Production%20AI%20Systems) | Kikimora Morozova, Suha Sabi Hussain | 2025 | | [Indirect Prompt Injection: Architectural Testing Approaches for Real World AI/ML Systems](https://github.com/trailofbits/publications/blob/master/presentations/Indirect%20Prompt%20Injection%3A%20Architectural%20Testing%20Approaches%20for%20Real%20World%20AI%20ML%20Systems) | Will Vandevanter | 2025 | | [From Polyglots to Prompt Injections: Parsing is Still Execution (And Your LLM Didn't Get the Memo)](https://github.com/trailofbits/publications/blob/master/presentations/From%20Polyglots%20to%20Prompt%20Injections%3A%20Parsing%20is%20Still%20Execution%20%28And%20Your%20LLM%20Didn%27t%20Get%20the%20Memo%29) | Evan Sultanik | 2025 | | [Frontier AI in Cybersecurity: Risks and Opportunities](https://github.com/trailofbits/publications/blob/master/presentations/Frontier%20AI%20in%20Cybersecurity%3A%20Risks%20and%20Opportunities) | Dan Guido, Riccardo Schirone | 2025 | | [The Present and Future of AI and Security](https://github.com/trailofbits/publications/blob/master/presentations/The%20Present%20and%20Future%20of%20AI%20and%20Security) | Evan Downing | 2024 | | [Incubated Machine Learning Exploits: Backdooring ML Pipelines Using Input-Handling Bugs](https://github.com/trailofbits/publications/blob/master/presentations/Incubated%20Machine%20Learning%20Exploits%3A%20Backdooring%20ML%20Pipelines%20Using%20Input-Handling%20Bugs) | Suha Sabi Hussain | 2024 | | [Holistic ML Threat Models](https://github.com/trailofbits/publications/blob/master/presentations/Holistic%20ML%20Threat%20Models) | Adelin Travers | 2024 | | [Using Graph-Based Machine Learning Algorithms for Software Analysis](https://github.com/trailofbits/publications/blob/master/presentations/Using%20Graph-Based%20Machine%20Learning%20Algorithms%20for%20Software%20Analysis) | Michael D. Brown | 2023 | | [Exploiting Machine Learning Pickle Files](https://github.com/trailofbits/publications/blob/master/presentations/Never%20a%20Dill%20Moment%3A%20Exploiting%20Machine%20Learning%20Pickle%20Files) | Carson Harmon, Evan Sultanik, Jim Miller, Suha Sabi Hussain | 2021 | | [PrivacyRaven: Comprehensive Privacy Testing for Deep Learning](https://github.com/trailofbits/publications/blob/master/presentations/PrivacyRaven%3A%20Comprehensive%20Privacy%20Testing%20for%20Deep%20Learning) | Suha Sabi Hussain | 2020 | ### Mobile security | Presentation Title | Author(s) | Year | | --- | --- | --- | | [macOS Privilege Escalation Via Traceroute6](https://github.com/trailofbits/publications/blob/master/presentations/macOS%20Privilege%20Escalation%20Via%20Traceroute6) | Paweł Płatek | 2025 | | [Swift Reversing](https://github.com/trailofbits/publications/blob/master/presentations/Swift%20Reversing) | Ryan Stortz | 2016 | | [Modern iOS Application Security](https://github.com/trailofbits/publications/blob/master/presentations/Modern%20iOS%20Application%20Security) | Sophia D'Antoine, Dan Guido | 2016 | | [The Mobile Exploit Intelligence Project](https://github.com/trailofbits/publications/blob/master/presentations/The%20Mobile%20Exploit%20Intelligence%20Project) | Dan Guido | 2012 | | [A Tale of Mobile Threats](https://github.com/trailofbits/publications/blob/master/presentations/A%20Tale%20of%20Mobile%20Threats) | Vincenzo Iozzo | 2012 | ### Programming | Presentation Title | Author(s) | Year | | --- | --- | --- | | [Python internals - let's talk about dicts](https://github.com/trailofbits/publications/blob/master/presentations/Python%20internals%20-%20lets%20talk%20about%20dicts) | Dominik Czarnota | 2019 | | [Low-level debugging with Pwndbg](https://github.com/trailofbits/publications/blob/master/presentations/Low-level%20debugging%20with%20Pwndbg) | Dominik Czarnota | 2018 | | [Insecure Things to Avoid in Python](https://github.com/trailofbits/publications/blob/master/presentations/Insecure%20Things%20to%20Avoid%20in%20Python) | Dominik Czarnota | 2018 | ### Side channels | Presentation Title | Author(s) | Year | | --- | --- | --- | | [Hardware side channels in virtualized environments](https://github.com/trailofbits/publications/blob/master/presentations/Hardware%20side%20channels%20in%20virtualized%20environments) | Sophia D'Antoine | 2015 | | [Exploiting Out-of-Order Execution](https://github.com/trailofbits/publications/blob/master/presentations/Exploiting%20Out-of-Order%20Execution) | Sophia D'Antoine | 2015 | ### Supply chain | Presentation Title | Author(s) | Year | | --- | --- | --- | | [Attestations: a new generation of signatures on PyPI](https://github.com/trailofbits/publications/blob/master/presentations/Attestations%3A%20a%20new%20generation%20of%20signatures%20on%20PyPI) | William Woodruff | 2025 | | [The Next 5 Years of Supply Chain Security on PyPI](https://github.com/trailofbits/publications/blob/master/presentations/The%20Next%205%20Years%20of%20Supply%20Chain%20Security%20on%20PyPI) | William Woodruff | 2024 | | [PEP 740 and PyPI: Bootstrapping Provenance for the Python Ecosystem](https://github.com/trailofbits/publications/blob/master/presentations/PEP%20740%20and%20PyPI%3A%20Bootstrapping%20Provenance%20for%20the%20Python%20Ecosystem) | William Woodruff | 2024 | | [Imagining a zero-trust future for PyPI](https://github.com/trailofbits/publications/blob/master/presentations/Imagining%20a%20zero-trust%20future%20for%20PyPI) | William Woodruff | 2024 | | [Build Provenance: Lessons (so far) from Homebrew](https://github.com/trailofbits/publications/blob/master/presentations/Build%20Provenance%3A%20Lessons%20%28so%20Far%29%20from%20Homebrew) | Joe Sweeney | 2024 | | [What does it look like to code-sign for an entire packaging ecosystem?](https://github.com/trailofbits/publications/blob/master/presentations/What%20does%20it%20look%20like%20to%20code-sign%20for%20an%20entire%20packaging%20ecosystem) | William Woodruff | 2023 | | [Securing your Package Ecosystem with Trusted Publishing](https://github.com/trailofbits/publications/blob/master/presentations/Securing%20your%20Package%20Ecosystem%20with%20Trusted%20Publishing) | William Woodruff | 2023 | | [Trusted Publishing: Lessons from PyPI](https://github.com/trailofbits/publications/blob/master/presentations/Trusted%20Publishing%3A%20Lessons%20from%20PyPI) | William Woodruff | 2023 | | [Ergonomic codesigning for the Python ecosystem with Sigstore](https://github.com/trailofbits/publications/blob/master/presentations/Ergonomic%20codesigning%20for%20the%20Python%20ecosystem%20with%20Sigstore) | William Woodruff | 2023 | | [Sigstore for Python Packaging: Next Steps for Adoption](https://github.com/trailofbits/publications/blob/master/presentations/Sigstore%20for%20Python%20Packaging%3A%20Next%20Steps%20for%20Adoption) | William Woodruff | 2022 | | [Python Packaging Mystery Meat](https://github.com/trailofbits/publications/blob/master/presentations/Python%20Packaging%20Mystery%20Meat) | William Woodruff | 2022 | | [Automated Tools for Securing the Software Supply Chain](https://github.com/trailofbits/publications/blob/master/presentations/Automated%20Tools%20for%20Securing%20the%20Software%20Supply%20Chain) | Michael D. Brown | 2022 | | [Improving PyPI's security with Two Factor Authentication](https://github.com/trailofbits/publications/blob/master/presentations/Improving%20PyPI%27s%20security%20with%20Two%20Factor%20Authentication) | William Woodruff | 2019 | ### Threat analysis & malware | Presentation Title | Author(s) | Year | | --- | --- | --- | | [Peeling back the 'Shlayers' of macOS Malware](https://github.com/trailofbits/publications/blob/master/presentations/Peeling%20back%20the%20Shlayers%20of%20macOS%20Malware) | Josh Watson, Erika Noerenberg | 2019 | | [The Exploit Intelligence Project Revisited](https://github.com/trailofbits/publications/blob/master/presentations/The%20Exploit%20Intelligence%20Project) | Dan Guido | 2013 | ## Podcasts | Podcast | Guest | Date | Topic(s) | | --- | --- | --- | --- | | [Risky Biz](https://risky.biz/RBNEWSSI114/) | Dan Guido | Feb 2026 | AI at Trail of Bits | | [What's in the SOSS? 53](https://openssf.org/podcast/2026/02/09/whats-in-the-soss-podcast-53-s3e5-aixcc-part-3-buttercups-hybrid-approach-trail-of-bits-journey-to-second-place-in-aixcc/) | Michael Brown | Feb 2026 | AIxCC & Buttercup | | [Insecure Agents 18](https://insecureagents.com/episodes/18-kiki-morozova) | Kikimora Morozova | Dec 2025 | AI prompt injections | | [Risky Biz](https://risky.biz/RBNEWSS198/) | Keith Hoodlet | Sep 2025 | AI prompt injections | | [Zero Signal](https://www.youtube.com/watch?v=G3pGCEQWJZs&list=PLvtGUUDFmi-aTEsna3wgfMrCH-DpZQJgn&index=2) | Keith Hoodlet | Sep 2025 | AI Security | | [Unsupervised Learning](https://www.youtube.com/watch?v=nvU0GbA9F9Q) | Michael Brown | Aug 2025 | AIxCC | | [Security Weekly 342](https://www.youtube.com/watch?v=C2kSdo7aNzU) | Will Vandevanter | Aug 2025 | NVIDIA vulnerability disclosure | | [CTF Radiooo 01E](https://youtu.be/BmCWryz3dsU?si=4T34d9DIP2MOcuo9) | Michael Brown & Evan Downing | Aug 2025 | AIxCC | | [Click Here Show](https://podcasts.apple.com/us/podcast/mic-drop-the-ego-exploit/id1225077306?i=1000712717394) | Dan Guido | Jun 2025 | Zoom remote control attacks | | [Security Weekly 336](https://youtu.be/1YvQi5Bc9_M?si=j-grngtTaI7Rloq6) | Artur Cygan | Jun 2025 | Fuzzing Barcodes | | [Protect AI](https://youtu.be/saLKE9y4EoU?si=9xqCNiY_Fx3ad9Mu) | Keith Hoodlet | Jun 2025 | MCP Security | | [Open Source Security](https://www.youtube.com/watch?v=EKXV6vxRTHM) | William Woodruff | May 2025 | Zizmor & GitHub Actions security | | [MLSecOps](https://youtu.be/8WsgV0svqPM?si=iB_9rUl33vPIT8sL) | Keith Hoodlet | Apr 2025 | AI/ML security | | [Risky Biz 786](https://youtu.be/DNAOwukOQi4?si=4KPfY2RnPMxVwSJJ&t=2556) | Tjaden Hess | Apr 2025 | Cryptography & blockchain | | [Security Weekly 323](https://youtu.be/zn3LT4BqOJo?si=3zY5YkRU4ArgM-vn) | Keith Hoodlet | Mar 2025 | GenAI in Appsec | | [Xyonix](https://youtu.be/y8TF7MELevg?si=gv60OR2_L86fsL2L) | Keith Hoodlet | Mar 2025 | AI/ML security | | [The Impulsive Thinker](https://theimpulsivethinker.libsyn.com/unlocking-ai-a-tool-not-a-magic-bullet-for-adhd-entrepreneurs) | Dan Guido | Feb 2025 | Neurodivergence | | [Bugcrowd](https://youtu.be/b7EULU_X7fQ?si=DZFenK1x00PaD5yV) | Keith Hoodlet | Oct 2024 | AI/ML Bias | | [Risky Biz](https://risky.biz/RBNEWSSI62/) | Dan Guido | Oct 2024 | Post-quantum cryptography | | [Risky Biz 759](https://youtu.be/4zpPk3Y4CYA?si=Pvd8px1DQHRPsRtM&t=3046) | Dan Guido | Aug 2024 | DARPA's AI Cyber Challenge | | [Resilience Rundown](https://www.youtube.com/watch?v=EB2oV1umU3Y&list=PLciHOL_J7IwpS8Cdl9lMB8Mxqu0as8yPi&index=7) | Josiah Dykstra | May 2024 | Bias in security | | [Risky Biz](https://risky.biz/RBNEWSSI40/) | Dan Guido | Apr 2024 | Open source tooling | | [MLSecOps March 20](https://mlsecops.com/podcast/redos-vulnerability-reports-security-relevance-vs.-noisy-nuisance) | William Woodruff | Mar 2024 | Supply chain security | | [yWhales](https://www.youtube.com/watch?v=LqkH1jYFE2g&list=PLciHOL_J7IwpS8Cdl9lMB8Mxqu0as8yPi&index=6) | Dan Guido | Dec 2023 | Blockchain security | | [Risky Biz 707](https://risky.biz/RB707/) | Dan Guido | May 2023 | ML security | | [ASW 229](https://youtu.be/wHuZzV0Da_s) | Nick Selby | Feb 2023 | Threat modeling, cloud-native audits | | [Risky Biz 690](https://risky.biz/RB690/) | Dan Guido | Jan 2023 | Vuln disclosure | | [Risky Biz 672](https://risky.biz/RB672/) | Dan Guido | Jul 2022 | Blockchain security | | [Cloud Security Reinvented](https://orca.security/resources/podcast/?blaid=3070895&wchannelid=v7ih6xfqse&wmediaid=ll04oa1n8n) | Nick Selby | Jun 2022 | Cloud security | | [Skiff Office Hours](https://twitter.com/i/web/status/1503822822237368321) | Dan Guido | Mar 2022 | Privacy technology | | [Risky Biz 652](https://risky.biz/RB652/) | Dan Guido | Jan 2022 | Zero-knowledge proofs | | [Secureum Safecast #3](https://www.youtube.com/watch?v=Ycj0ZVWof5E) | Josselin Feist | Nov 2021 | Blockchain security | | [Secureum Safecast #2](https://www.youtube.com/watch?v=NSzniIpPYdw) | Dan Guido | Oct 2021 | Blockchain security | | [Press Freedom Foundation](https://www.twitch.tv/videos/1102962356) | Dan Guido | Jul 2021 | Mobile security and iVerify | | [Employee Cycle](https://employeecycle.com/podcast/how-to-onboard-yourself-as-the-first-people-leader-with-hannah-hanks/) | Hannah Hanks | Mar 2021 | First PeopleOps hire | | [Risky Biz 614](https://risky.biz/RB614/) | Dan Guido | Feb 2021 | iVerify | | [Building Better Systems 6](https://www.youtube.com/watch?v=QXF6agsYqV0) | Dan Guido | Jan 2021 | What blockchain got right | | [WCBS 880](https://www.radio.com/podcasts/wcbs-880-small-business-spotlight-32986/pandemic-gap-year-leads-to-career-development-322317063) | Dan Guido | Sep 2020 | Gap years and intern hiring | | [Risky Biz 594](https://risky.biz/RB594/) | Dan Guido | Aug 2020 | Apple security | | [Epicenter 346](https://epicenter.tv/episodes/346) | Dan Guido | Jun 2020 | Smart contract security | | [Absolute AppSec 97](https://www.youtube.com/watch?v=GvNXxOc30lM) | Stefan Edwards | May 2020 | Threat modeling | | [Unchained 170](https://unchainedpodcast.com/defi-security-with-so-many-hacks-will-it-ever-be-safe/) | Dan Guido | May 2020 | DeFi security | | [Risky Biz 580](https://risky.biz/RB580/) | Dan Guido | Apr 2020 | Mobile voting | | [Absolute AppSec 91](https://www.youtube.com/watch?v=HlGcJRhgNG0) | Stefan Edwards | Apr 2020 | Mobile voting | | [Zero Knowledge 122](https://www.zeroknowledge.fm/122) | Ben Perez | Mar 2020 | Cryptography reviews, ZKPs | | [Changelog](https://changelog.com/podcast/377) | Dan Guido | Jan 2020 | AlgoVPN | | [Risky Business 559](https://risky.biz/RB559/) | Stefan Edwards | Oct 2019 | Kubernetes | | [FOSS Weekly 545](https://www.youtube.com/watch?v=mkjoTAdZd3Q) | William Woodruff | Sep 2019 | PyPI security improvements | | [`Podcast.__init__` 225](https://www.pythonpodcast.com/pypi-improvements-episode-225/) | William Woodruff | Aug 2019 | PyPI security, UX, and sustainability | | [Absolute AppSec 68](https://www.youtube.com/watch?v=bOR21l96zz4) | Stefan Edwards, Bobby Tonic | Aug 2019 | Kubernetes | | [Hashing it Out 53](https://thebitcoinpodcast.com/hashing-it-out-53/) | Dan Guido | Jul 2019 | Smart contract testing | | [Absolute AppSec 60](https://www.youtube.com/watch?v=BZ0U7K0IxNQ) | Stefan Edwards | May 2019 | Android, programming languages | | [Absolute AppSec 55](https://www.youtube.com/watch?v=Q0pKAlGLFtY) | Stefan Edwards | Apr 2019 | Security testing | | [Hashing it Out 35](https://thebitcoinpodcast.com/hashing-it-out-35/) | Dan Guido, Josselin Feist | Jan 2019 | Ethereum's failed EIP-1283 | | [Risky Biz 526](https://risky.biz/RB526/) | JP Smith | Jan 2019 | Post-quantum crypto in CTFs | | [Absolute AppSec 37](https://www.youtube.com/watch?v=beGo7l0u5cY) | Stefan Edwards | Nov 2018 | Programming languages, symbex | | [Risky Biz 510](https://risky.biz/RB510/) | Lauren Pearl | Aug 2018 | Open source security engineering | | [Absolute AppSec 34](https://www.youtube.com/watch?v=gtikYoT6vKc) | Stefan Edwards | Oct 2018 | Security testing, blockchain | | [The Smartest Contract 15](https://web.archive.org/web/20181018135712/http://www.thesmartestcontract.com/15) | JP Smith | Aug 2018 | Trail of Bits security tools & auditing | | [Zero Knowledge 16](https://www.zeroknowledge.fm/16) | JP Smith | Mar 2018 | Smart contract security | | [Risky Biz 488](https://risky.biz/RB488/) | JP Smith | Feb 2018 | Smart contract testing w/ Manticore | | [Risky Biz 474](https://risky.biz/RB474/) | Dan Guido | Oct 2017 | How to engineer secure software | | [Georgian Partners 47](https://georgianpartners.com/the-problem-with-the-tor-network-and-commercial-vpns/) | Dan Guido | May 2017 | [AlgoVPN](https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/) and Tor | | [VUC 643](https://www.youtube.com/watch?v=r_FV-uHYDgs) | Dan Guido | Apr 2017 | [AlgoVPN](https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/) | | [Risky Biz 449](https://risky.biz/RB449/) | Dan Guido | Mar 2017 | Control Flow Integrity | | [Risky Biz 425](https://risky.biz/RB425/) | Dan Guido | Sep 2016 | Recap the week's news | | [Risky Biz 421](https://risky.biz/RB421/) | Dan Guido | Aug 2016 | Car hacking and the week's news | | [Risky Biz 416](https://risky.biz/RB416/) | Dan Guido | Jul 2016 | DARPA Cyber Grand Challenge | | [Risky Biz 399](https://risky.biz/RB399/) | Dan Guido | Feb 2016 | [Apple vs the FBI](https://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-order/) | | [Risky Biz 348](https://risky.biz/RB348/) | Dan Guido | Jun 2015 | DARPA Cyber Grand Challenge | | [Risky Biz 370](https://risky.biz/RB370/) | Dan Guido | Feb 2015 | DARPA Cyber Grand Challenge | ## Webinars | Title | Speakers | Date | | --- | --- | --- | | [Top TEE bugs you should fix before your audit](https://watch.getcontrast.io/register/trail-of-bits-top-tee-bugs-you-should-fix-before-your-audit) | Tjaden Hess, Paul Bottinelli, & Jules Drean | Dec 2025 | | [Building secure end-to-end encrypted systems](https://watch.getcontrast.io/register/trail-of-bits-running-effective-threat-models-in-e2ee) | Marc Ilunga & Fredrik Dahlgren | Dec 2025 | | [After Wiretap and Battering RAM: What Changes for TEE-Based Blockchain Infrastructure](https://watch.getcontrast.io/register/trail-of-bits-after-wiretap-and-battering-ram-what-changes-for-tee-based-blockchain-infrastructure) | Tjaden Hess & Andy Campbell | Nov 2025 | | [MCP Security Deep Dive: From Attacks to Defense](https://app.getcontrast.io/register/trail-of-bits-mcp-security-deep-dive-from-vulnerability-to-defense) | Keith Hoodlet, Cliff Smith, Vineeth Sai Narajala, Manish Bhatt | Jul 2025 | | [Security Audits: Best Practices with Trail of Bits](https://workbrew.com/webinars/security-audits) | Chris Dahlheimer, Lindsay Rakowski, & Vanessa Gennarelli | Mar 2025 | | [Mastering Web Research with Burp Suite](https://www.youtube.com/watch?v=0PV5QEQTmPg) | Keith Hoodlet, Cliff Smith, & James Kettle | Jun 2024 | | [Introduction to CodeQL: Examples, Tools and CI Integration](https://www.youtube.com/watch?v=rQRlnUQPXDw) | Filipe Casal & Fredrik Dahlgren | Mar 2024 | | [Introduction to Semgrep](https://www.youtube.com/watch?v=yKQlTbVlf0Q) | Maciej Domanski & Matt Schwager | Jan 2024 | ## Public Comments | Topic | Agency | Date | | --- | --- | --- | | [Automated Artifical Intelligence Bill Of Materials for AI/ML Ops](https://github.com/trailofbits/publications/blob/master/public-comments/AIBOM-RFI-response.pdf) | U.S. Army PEO IEW&S | Dec 2023 | | [Open-Source Software Security: Areas of Long-Term Focus and Prioritization](https://github.com/trailofbits/publications/blob/master/public-comments/tob-response-to-oncd-cisa-rfi-2023.pdf) | ONCD, CISA, NSF, DARPA, OMB | Nov 2023 | | [Understanding the National Security Implications of AI](https://github.com/trailofbits/publications/blob/master/public-comments/whitehouse_otsp_national_security_ai.pdf) | Whitehouse OTSP | Jul 2023 | | [AI Accountability, Regulation, and Audits](https://blog.trailofbits.com/2023/06/16/trail-of-bitss-response-to-ntia-ai-accountability-rfc/) | NTIA | Jun 2023 | | [A Comprehensive Risk Assessment Framework for AI Assurance in Ethical, Legal, and Societal Domains](https://github.com/trailofbits/publications/blob/master/public-comments/comprehensive-risk-assessment-framework-AI-Assurance-ELS-Domains.pdf) | DARPA | Jun 2023 | | [Understanding Crypto Markets Security](https://github.com/trailofbits/publications/blob/master/presentations/public/CFTC_TAC_presentation_March_2023.pdf) | CFTC | Mar 2023 | | [Regulation of Intrusion and Surveillance Software](https://www.regulations.gov/document/BIS-2015-0011-0209) | Commerce Dept | Jul 2015 | ## Case Studies In-depth looks at how clients have worked with Trail of Bits: the challenge, our approach, and the outcomes. Level of effort is in engineer-weeks. | Client | Focus | Date | Level of
Effort | Case Study | | --- | --- | --: | :-: | :-: | | [Turnkey](https://www.turnkey.com/) | TEE and AWS Nitro Enclaves infrastructure | Jun 2026 | 8 | [📖](https://github.com/trailofbits/publications/blob/master/case-studies/turnkey-casestudy.pdf) | | [Vanta](https://www.vanta.com/) | Multi-tenant isolation architecture review | Nov – Dec 2025 | 6 | [📖](https://github.com/trailofbits/publications/blob/master/case-studies/vanta-casestudy.pdf) | | [Scopely](https://www.monopolygo.com/) | Monopoly GO! PRNG fairness design assessment | Dec 2024 | 2 | [📖](https://github.com/trailofbits/publications/blob/master/case-studies/scopely-monopolygo-casestudy.pdf) | | [Hugging Face](https://huggingface.co/gradio) | Gradio 5.0 pre-release security assessment | Jun – Jul 2024 | 4 | [📖](https://github.com/trailofbits/publications/blob/master/case-studies/huggingface-gradio-casestudy.pdf) | | [Scroll](https://scroll.io/) | zkEVM circuit security reviews | Apr – Sep 2023 | 45.8 | [📖](https://github.com/trailofbits/publications/blob/master/case-studies/scroll-zkevm-casestudy.pdf) | ## Security Reviews Companies that have allowed us to speak about our work can be found here. Many more remain confidential. ### Major Clients The following clients have engaged Trail of Bits for 5 or more security reviews: #### Frax Finance | Product | Date | Level of
Effort | Announcement | Report | | --- | --: | :-: | --- | :-: | | [FraxGov](https://frax.finance/) | May 2023 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-05-fraxgov-securityreview.pdf) | | [Fraxlend and veFPIS](https://frax.finance/) | Jan 2023 | 4 | | | | [Fraxlend and FraxFerry](https://frax.finance/) | Oct 2022 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2022-10-fraxfinance-fraxlend-fraxferry-securityreview.pdf) | | [Frax](https://frax.finance/) | May 2022 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/FraxQ22022.pdf) | | [Frax](https://frax.finance/) | Dec 2021 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/FraxQ42021.pdf) | | [Frax](https://frax.finance/) | May 2021 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/FraxFinance.pdf) | #### MobileCoin | Product | Date | Level of
Effort | Announcement | Report | | --- | --: | :-: | --- | :-: | | [MobileCoin](https://mobilecoin.com/homepage) | Jul 2022 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2022-07-mobilecoin-securityreview.pdf) | | [Fog Protocol](https://www.mobilecoin.com/) | Jan 2021 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/MobilecoinFog.pdf) | | [MobileCoin BFT](https://www.mobilecoin.com/) | Oct 2020 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/MobileCoinBFT.pdf) | | [MobileCoin](https://www.mobilecoin.com/) | Aug 2020 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Mobilecoin.pdf) | #### Offchain Labs | Product | Date | Level of
Effort | Announcement | Report | | --- | --: | :-: | --- | :-: | | [Offchain Labs Arbitrum ArbOS 60/61](https://www.offchainlabs.com/) | Jul 2026 | 24 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2026-07-offchainlabs-arbitrumarbos6061-securityreview.pdf) | | [Offchain Labs Reward Distributor Fixes](https://www.offchainlabs.com/) | Jun 2026 | 0.8 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2026.06-offchainlabs-rewarddistributorfixes-securityreview.pdf) | | [Offchain Labs Stylus SDK](https://www.offchainlabs.com/) | Apr 2026 | 9 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2026-04-offchain-stylus-sdk-securityreview.pdf) | | [Offchain Labs Arbitrum Quorum Changes](https://www.offchainlabs.com/) | Feb 2026 | 1.2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2026-02-offchain-arbitrum-quorum-changes-securityreview.pdf) | | [Offchain Labs Arbitrum Nitro External DA](https://www.offchainlabs.com/) | Jan 2026 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-01-offchain-nitro-external-da-securityreview.pdf) | | [Offchain Labs Arbitrum ArbOS 50 and 51 (Fusaka)](https://www.offchainlabs.com/) | Dec 2025 | | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-12-offchain-arbos50-and-51-securityreview.pdf) | | [Offchain Labs Arbitrum Chains Genesis File Generator](https://www.offchainlabs.com/) | Dec 2025 | 1.6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-12-offchain-arbitrum-chains-genesis-generator-securityreview.pdf) | | [Offchain Labs Upgrade Executor](https://www.offchainlabs.com/) | Jul 2025 | 0.2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-07-offchain-upgrade-executor-securityreview.pdf) | | [Offchain SetCoreGovernorQuorumAction](https://www.offchainlabs.com/) | Jun 2025 | 1.2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-06-offchain-setcoregovernorquorumaction-securityreview.pdf) | | [Offchain Arbitrum Mint/Burn Precompile](https://www.offchainlabs.com/) | Jun 2025 | 1.8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-06-offchain-arbitrum-mint-burn-precompile-securityreview.pdf) | | [Offchain Arbitrum Block Hash Pusher](https://www.offchainlabs.com/) | Jun 2025 | 1.8 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-06-offchain-arbitrum-block-hash-pusher-securityreview.pdf) | | [Offchain ArbOS 40 Nitro](https://www.offchainlabs.com/) | May 2025 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-05-offchainlabs-arbos40nitro-securityreview.pdf) | | [Offchain Reward Distributor Fixes](https://www.offchainlabs.com/) | Apr 2025 | 0.8 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-04-offchainlabs-reward-distributor-fixes-securityreview.pdf) | | [Offchain Sequencer Liveness](https://www.offchainlabs.com/) | Mar 2025 | 3 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-03-offchain-sequencer-liveness-securityreview.pdf) | | [Offchain Custom Fee Bridge & EIP-7702](https://www.offchainlabs.com/) | Mar 2025 | 1 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-03-offchain-custom-fee-erc20-bridge-securityreview.pdf) | | [Offchain Geth 14.4 Pectra](https://www.offchainlabs.com/) | Mar 2025 | 0.8 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-03-offchain-geth-14.4-securityreview.pdf) | | [Offchain Custom Fee Exchange Rate](https://www.offchainlabs.com/) | Mar 2025 | 1 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-03-offchain-custom-fee-token-exchange-rate-securityreview.pdf) | | [Offchain Security Council Rotation](https://www.offchainlabs.com/) | Mar 2025 | 1.6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-03-offchain-security-council-rotation-securityreview.pdf) | | [Offchain DisableGateway USDT](https://www.offchainlabs.com/) | Mar 2025 | 0.4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-03-offchain-disablegateway-action-securityreview.pdf) | | [Offchain BoLD Fixes](https://www.offchainlabs.com/) | Dec 2024 | 0.8 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-12-offchain-boldfixes-securityreview.pdf) | | [Offchain Stylus Emergency Fixes](https://www.offchainlabs.com/) | Oct 2024 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-10-offchain-stylus-emergency-fixes-securityreview.pdf) | | [Offchain BoLD History Commits](https://www.offchainlabs.com/) | Oct 2024 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-10-offchain-bold-optimized-history-commit-securityreview.pdf) | | [Offchain Nitro with BoLD](https://www.offchainlabs.com/) | Oct 2024 | 2.6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-10-30-Offchain-NitroContractswithBoLD-securityreview.pdf) | | [Offchain Stylus](https://www.offchainlabs.com/) | Sep 2024 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-09-offchain-stylus-securityreview.pdf) | | [Offchain RARI](https://www.offchainlabs.com/) | Aug 2024 | 0.6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-08-offchainlabs-register-and-set-arb-custom-gateway-action-governance-action-securityreview.pdf) | | [Offchain Office Hours Action](https://www.offchainlabs.com/) | Aug 2024 | 0.6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-08-offchainlabs-office-hours-governance-action-securityreview.pdf) | | [Offchain Timeboost Auction](https://www.offchainlabs.com/) | Aug 2024 | 3 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-08-offchainlabs-timeboost-auction-contracts-securityreview.pdf) | | [Offchain Orbit Actions](https://www.offchainlabs.com/) | Aug 2024 | 1 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-08-offchainlabs-orbit-actions-securityreview.pdf) | | [Offchain USDC Gateway](https://www.offchainlabs.com/) | Jul 2024 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-08-offchainlabs-usdc-custom-gateway-securityreview.pdf) | | [Offchain BoLD & DAC Rewards](https://www.offchainlabs.com/) | Jun 2024 | 3 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-06-offchain-labs-bold-dac-rewards-updates-securityreview.pdf) | | [Offchain Arbitrum Stylus](https://www.offchainlabs.com/) | May 2024 | 47 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-05-offchain-arbitrumstylus-securityreview.pdf) | | [Offchain L1-L3 Teleporter](https://www.offchainlabs.com/) | Apr 2024 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-04-offchain-l1-l3-teleporter-securityreview.pdf) | | [Offchain ArbOS 31](https://www.offchainlabs.com/) | Apr 2024 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-04-offchain-arbos-31-securityreview.pdf) | | [Offchain ArbOS 30 Nitro](https://www.offchainlabs.com/) | Apr 2024 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-04-offchain-arbos-30-nitro-upgrade-securityreview.pdf) | | [Offchain BoLD](https://www.offchainlabs.com/) | Apr 2024 | 5 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-04-offchainbold-securityreview.pdf) | | [Offchain ArbOS](https://www.offchainlabs.com/) | Feb 2024 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-02-offchainlabsarbos-securityreview.pdf) | | [Offchain Arbitrum](https://www.offchainlabs.com/) | Jan 2024 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-01-offchainarbitrum-securityreview.pdf) | | [Offchain Token Bridge Creator](https://www.offchainlabs.com/) | Dec 2023 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-12-offchain-labs-arbitrum-token-bridge-creator-securityreview.pdf) | | [Offchain Custom Fee Token](https://www.offchainlabs.com/) | Sep 2023 | 3 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-09-offchain-labs-custom-fee-token-securityreview.pdf) | | [Offchain Arbitrum Challenge v2](https://www.offchainlabs.com/) | Aug 2023 | 20 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-8-offchain-challenge-protocol-V2-securityreview.pdf) | #### Reserve Protocol | Product | Date | Level of
Effort | Announcement | Report | | --- | --: | :-: | --- | :-: | | [Reserve Protocol Solidity 4.0.0](https://reserve.org/) | Jun 2025 | 3.6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-06-reserveprotocol-solidity400-securityreview.pdf) | | [Reserve Protocol Solana DTFs](https://reserve.org/) | Apr 2025 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-04-reserve-solana-dtfs-securityreview.pdf) | | [Reserve Folio Solidity-Based Contracts](https://reserve.org/) | Apr 2025 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-04-reserve-folio-solidity-securityreview.pdf) | | [Reserve Protocol](https://reserve.org/) | Aug 2022 | 8 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2022-08-reserve-protocol-securityreview.pdf), [✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-08-reserve-protocol-fixreview.pdf) | | [Reserve Protocol](https://reserve.org/) | Mar 2019 | 1 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Reserve_LOA.pdf) | #### Scroll | Product | Date | Level of
Effort | Announcement | Report | | --- | --: | :-: | --- | :-: | | [Scroll Feynman Upgrade Smart Contract Changes](https://scroll.io/) | Jul 2025 | 1 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-07-scroll-feynmanupgradesmartcontractchanges-securityreview.pdf) | | [Scroll Euclid Phase 2](https://scroll.io) | Apr 2025 | 4 | [Scroll](https://gov.scroll.io/proposals/81939631158579841171219988954315753236293867421581097385921335841780903893992) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-04-scroll-euclid-phase2-securityreview.pdf)[🔖](https://github.com/trailofbits/publications/blob/master/reviews/2025-03-scroll-euclidphase2-loa.pdf) | | [Scroll Euclid Phase 1](https://scroll.io) | Apr 2025 | 3 | [Scroll](https://gov.scroll.io/proposals/81939631158579841171219988954315753236293867421581097385921335841780903893992) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-04-scroll-euclid-phase1-securityreview.pdf)[🔖](https://github.com/trailofbits/publications/blob/master/reviews/2025-03-scroll-euclidphase1-loa.pdf) | | [Scroll zstd Compression](https://scroll.io/) | Jun 2024 | 12 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-06-scroll-zstd-compression-securityreview.pdf) | | [Scroll ZkEVM 4844 Blob](https://scroll.io/) | Apr 2024 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-04-scroll-4844-blob-securityreview.pdf) | | [Scroll ZkEVM Wave 3](https://scroll.io/) | Sep 2023 | 9 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-09-scroll-zkEVM-wave3-securityreview.pdf) | | [Scroll l2geth [diff] ](https://scroll.io/) | Aug 2023 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-08-scrollL2geth-securityreview.pdf) | | [Scroll l2geth [initial]](https://scroll.io/) | Aug 2023 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-08-scrollL2geth-initial-securityreview.pdf) | | [Scroll ZkEVM Wave 2](https://scroll.io/) | Aug 2023 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-08-scroll-zkEVM-wave2-securityreview.pdf) | | [Scroll zkTrie](https://scroll.io/) | Jul 2023 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-07-scroll-zktrie-securityreview.pdf) | | [Scroll ZkEVM Wave 1](https://scroll.io/) | Apr 2023 | 23 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-04-scroll-zkEVM-wave1-securityreview.pdf) | #### Uniswap | Product | Date | Level of
Effort | Announcement | Report | | --- | --: | :-: | --- | :-: | | [Uniswap v4 Core](https://docs.uniswap.org/contracts/v4/concepts/intro-to-v4) | Jul 2024 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-07-uniswap-v4-core-securityreview.pdf) | | [Uniswap Browser Extension](https://uniswap.org/) | Feb 2024 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-02-uniswap-wallet-browserextension-securityreview.pdf) | | [Uniswap](https://uniswap.org/) | Sep 2023 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-09-uniswap-wallet-securityreview.pdf) | | [Uniswap Mobile Wallet](https://freewallet.org/uni-wallet) | Aug 2022 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/UniswapMobileWallet-securityreview.pdf)[✅](https://github.com/trailofbits/publications/blob/master/reviews/UniswapMobileWallet-fixreview.pdf) | | [Uniswap V3 Staker](https://uniswap.org/blog/uniswap-v3/) | Jun 2021 | 2 | | | | [Uniswap V3](https://uniswap.org/) | Mar 2021 | 10 | [Uniswap](https://uniswap.org/blog/uniswap-v3/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/UniswapV3Core.pdf) | #### Western Digital | Product | Date | Level of
Effort | Announcement | Report | | --- | --: | :-: | --- | :-: | | [ArmorLock](https://www.westerndigital.com/) | Apr 2022 | 6 | | | | [Optimus ROM](https://www.westerndigital.com/) | Jan 2022 | 4 | | | | [Secure Transport](https://www.westerndigital.com/) | Apr 2020 | 4 | | | [Western Digital Sweet B](https://github.com/westerndigitalcorporation/sweet-b) | Jan 2020 | 4 | [Western Digital](https://www.westerndigital.com/company/newsroom/press-releases/2020/2020-09-03-western-digital-sets-a-new-standard-in-data-protection) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/SweetB.pdf) | | [SanDisk X600](https://www.westerndigital.com/) | May 2019 | 6 | [Multiple vulnerabilities in SanDisk X600](https://www.westerndigital.com/support/productsecurity/wdc-19006-sandisk-x600-sata-ssd) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/sandiskx600.pdf) | ### AI/ML Reviews | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | [YOLOv7](https://github.com/WongKinYiu/yolov7/) | Oct 2023 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-10-yolov7-securityreview.pdf) | | [SafeTensors](https://github.com/huggingface/safetensors) | Mar 2023 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-03-eleutherai-huggingface-safetensors-securityreview.pdf) | ### Cryptography Reviews | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | [MAGIC Grants Monero FCMP ++ Crypto](https://magicgrants.org/) | Jul 2026 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-07-magicgrants-monerofcmp%2B%2Bcrypto-securityreview.pdf) | | [Ripple Labs XRP Ledger Confidential Transfer](https://ripple.com/) | Apr 2026 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-04-ripple-labs-xrp-ledger-confidential-transfer-securityreview.pdf) | | [HyperLink AWS Nitro TEE](https://hyperlink.xyz/) | Mar 2026 | 2.2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-03-hyperlink-awsnitrotee-securityreview.pdf) | | [Open Home Foundation SecureTar v3](https://www.openhomefoundation.org/) | Mar 2026 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-03-open-home-foundation-securetar-v3-securityreview.pdf) | | [Obsidian Sync](https://obsidian.md/) | Dec 2025 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025.12-obsidiansync-securityreview.pdf) | | [NEAR One PedPop+](https://nearone.org/) | May 2025 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-05-near-one-pedpop%2B-securityreview.pdf) | | [NEAR One MPC Chain Signatures](https://docs.near.org/chain-abstraction/chain-signatures) | Mar 2025 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-03-near-one-mpc-chain-signatures-securityreview.pdf) | | [NEAR One Robust ECDSA](https://docs.near.org/chain-abstraction/chain-signatures) | Feb 2026 | 6.4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-02-near-one-robust-ecdsa-securityreview.pdf) | | [Anza BLS Signatures](https://anza.xyz) | Mar 2026 | 1 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2026-03-anza-blssignatures-securityreview.pdf) | | [DV Labs Charon Pedersen DKG](https://github.com/ObolNetwork/charon) | Feb 2026 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-02-dv-labs-charon-pedersen-dkg-securityreview.pdf) | | [Anza Token-2022 Confidential Transfer, Cryptography](https://www.anza.xyz/) | Jan 2026 | 7 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2026-01-anza-token-2022-confidential-transfer-cryptography-securityreview.pdf) | | [Calyx Institute HSM Provisioning Ceremony Scripts](https://calyxos.org/) | Jan 2026 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-01-calyx-hsm-provisioning-ceremony-scripts-securityreview.pdf) | | [BSV Blockchain TS-SDK](https://bsvassociation.org/) | Jan 2026 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-01-bsv-association-ts-sdk-securityreview.pdf) | | [Bron Labs MCP Library](https://bron.org/) | Jan 2026 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-01-bron-mcp-securityreview.pdf) | | [NEAR One Confidential Key Derivation](https://docs.near.org/chain-abstraction/chain-signatures) | Dec 2025 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-12-near-one-confidential-key-derivation-securityreview.pdf) | | [Zama](https://docs.zama.org/protocol/zama-protocol-litepaper) | Oct 2025 | 32.2 | | | | [DFINITY Orbit](https://dfinity.org/) | Sep 2025 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-09-dfinity-orbit-securityreview.pdf) | | [DFINITY Oisy](https://oisy.com/) | Sep 2025 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-09-dfinity-oisy-securityreview.pdf) | | [Google Longfellow](https://github.com/google/longfellow-zk) | Aug 2025 | 4.6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-08-googlelongfellow-securityreview.pdf) | | [Open Quantum Safe liboqs](https://openquantumsafe.org/) | Apr 2025 | 5 | [Open Quantum Safe](https://openquantumsafe.org/liboqs/security.html) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-04-quantum-open-safe-liboqs-securityreview.pdf) | | [Go Crypto Libraries](https://go.dev) | Mar 2025 | 12 | [Go](https://go.dev/blog/tob-crypto-audit) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-03-google-gocryptographiclibraries-securityreview.pdf) | | [Zkonduit EZKL](https://github.com/zkonduit/ezkl) | Mar 2025 | 11 | [EZKL](https://blog.ezkl.xyz/post/audit/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-03-zkonduit-ezkl-securityreview.pdf) | | [Scopely Monopoly Go!](https://www.monopolygo.com) | Dec 2024 | 2 | | [🔖](https://github.com/trailofbits/publications/blob/master/reviews/2025-01-scopely-monopolygo-letterofattestation.pdf) | | [Aligned](https://www.alignedlayer.com/) | Dec 2024 | 3 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-12-alignedlayer-aligned-securityreview.pdf) | | [Discord DAVE](https://discord.com/) | Sep 2024 | 5 | [Discord](https://discord.com/blog/meet-dave-e2ee-for-audio-video) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-09-discord-dave-protocol-codereview.pdf) | | [Discord DAVE](https://discord.com/) | Aug 2024 | 4 | [Discord](https://discord.com/blog/meet-dave-e2ee-for-audio-video) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-08-discord-dave-protocol-designreview.pdf) | | [Lit Protocol Cait-Sith](https://www.litprotocol.com/) | Jun 2024 | 10 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-06-lit-protocol-cait-sith-securityreview.pdf) | | [Iron Fish FishHash](https://ironfish.network/) | Apr 2024 | 1 | [Iron Fish](https://ironfish.network/learn/blog/2024-05-14-fish-hash-audit) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-04-ironfish-fishhash-securityreview.pdf) | | [AgileBits Snow](https://github.com/mcginty/snow) | Mar 2024 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-03-agilebits-snow-securityreview.pdf) | | [Silence Laboratories Silent Shard](https://www.silencelaboratories.com) | Feb 2024 | 5 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-02-silencelaboratories-silentshard-securityreview.pdf) | | [Snow](https://github.com/mcginty/snow) | Jan 2024 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-01-agilebits-snow-securityreview.pdf) | | [Ockam](https://docs.ockam.io) | Nov 2023 | 11 | [Trail of Bits](https://blog.trailofbits.com/2024/03/05/cryptographic-design-review-of-ockam/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-11-ockam-designreview.pdf) | | [Dfinity Candid](https://dfinity.org/) | Nov 2023 | 3 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-11-dfinity-candid-securityreview.pdf) | | [Axiom Halo2 Library Upgrades](https://www.axiom.xyz/) | Oct 2023 | 6 | [Axiom](https://docs.axiom.xyz/docs/transparency-and-security/security) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-10-axiom-halo2libraryupgrades-securityreview.pdf) | | [Aleo snarkVM, snarkOS, BullsharkBFT](https://aleo.org/) | Oct 2023 | 18 | [Aleo](https://aleo.org/post/aleo-completes-security-audits-of-snarkos-and-snarkvm/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-10-aleo-securityreview.pdf) | | [Axiom Halo2 Libraries](https://www.axiom.xyz/) | Jun 2023 | 14 | [Axiom](https://docs.axiom.xyz/docs/transparency-and-security/security) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-06-axiom-halo2libraries-securityreview.pdf) | | [Dfinity ckBTC and BTC Integration](https://dfinity.org/) | Jun 2023 | 2.5 | [Forum](https://forum.dfinity.org/t/ckbtc-and-service-nervous-system-sns-third-party-security-assessments-by-trail-of-bits/24380), [Blog](https://medium.com/dfinity/taking-security-seriously-two-top-icp-features-assessed-by-trail-of-bits-4a0023ab1e68) | | | [Dfinity SNS Phase 2](https://dfinity.org/) | Jun 2023 | 2.5 | [Forum](https://forum.dfinity.org/t/ckbtc-and-service-nervous-system-sns-third-party-security-assessments-by-trail-of-bits/24380), [Blog](https://medium.com/dfinity/taking-security-seriously-two-top-icp-features-assessed-by-trail-of-bits-4a0023ab1e68) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-06-dfinity-sns-securityreview.pdf) | | [Thesis tss-lib BitForge](https://threshold.network/) | Jun 2023 | 0.2 | [Threshold](https://blog.threshold.network/bitforge-and-tsshock/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-06-thesistsslib-securityreview.pdf) | | [Chainflip](https://chainflip.io/) | Apr 2023 | 12 | [Chainflip](https://blog.chainflip.io/trail-of-bits-security-audit/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-04-chainflip-securityreview.pdf) | | [Stealth Addresses](https://gist.github.com/shea256/e4a8dccd1e83fa801c7328a0af611798) | Feb 2023 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-02-ryanshea-practicalstealthaddresses-securityreview.pdf) | | [Succinct ZK Light Client](https://www.succinct.xyz/) | Feb 2023 | 8 | [Succinct](https://blog.succinct.xyz/blog/telepathy) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-02-succinct-securityreview.pdf) | | [noble-curves Library](https://github.com/paulmillr/noble-curves) | Jan 2023 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-01-ryanshea-noblecurveslibrary-securityreview.pdf) | | [ParaSpace](https://para.space/) | Dec 2022 | 1 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/ParallelFinance3.pdf) | | [Phantom Wallet](https://phantom.app/) | Nov 2022 | 2 | | | | [ParaSpace](https://para.space/) | Nov 2022 | 7 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/ParallelFinance2.pdf)[✅](https://github.com/trailofbits/publications/blob/master/reviews/ParallelFinance2FixReview.pdf) | | [SimpleX Chat](https://simplex.chat/) | Oct 2022 | 1 | [SimpleX](https://simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/SimpleXChat.pdf) | | [Dfinity](https://dfinity.org/) | Sep 2022 | 4 | [Forum](https://forum.dfinity.org/t/ckbtc-and-service-nervous-system-sns-third-party-security-assessments-by-trail-of-bits/24380), [Blog](https://medium.com/dfinity/taking-security-seriously-two-top-icp-features-assessed-by-trail-of-bits-4a0023ab1e68) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-09-dfinity-sns-securityreview.pdf) | | [Aleo snarkVM](https://www.aleo.org/) | Sep 2022 | 12 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-09-aleosystems-snarkvm-securityreview.pdf) | | [Microsoft/Verasion Go-COSE](https://github.com/veraison) | Jul 2022 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-07-microsoft-go-cose-securityreview.pdf) | | [BLS Signature Scheme](https://www.binance.com/) | Jul 2022 | 1 | | | | [Binance CGGMP21 and FROST](https://www.binance.com/) | May 2022 | 8 | | | | [Aleo snarkVM & snarkOS](https://www.aleo.org/) | Apr 2022 | 12 | | | | [Phantom Wallet](https://phantom.app/) | Apr 2022 | 4 | | | | [Parallel Finance](https://parallel.fi/) | Mar 2022 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/ParallelFinance.pdf) | | [Polkadex](https://www.polkadex.trade/) | Feb 2022 | 10 | | | | [Linux Kernel](https://kernelci.org/about/) | Apr 2021 | 2 | [Release Signing and Management](https://ostif.org/a-review-of-the-linux-kernels-release-signing-and-key-management-policies/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/LinuxKernelReleaseSigning.pdf) | | [Standard Notes](https://standardnotes.com/) | Mar 2020 | 1 | [Standard Notes](https://standardnotes.com/blog/standard-notes-security-audits-2021) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/StandardNotes.pdf) | | [Project Callisto](https://www.projectcallisto.org/) | Aug 2018 | 5 | | | ### Technology Product Reviews | Product | Date | Level of
Effort | Announcement | Report | | --- | --: | :-: | --- | :-: | | [PyTorch ExecuTorch](https://pytorch.org/projects/executorch/) | Jun 2026 | 9 | [OSTIF](https://ostif.org/pytorch-executorch-audit-complete/)| [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-06-pytorch-executorch-securityreview.pdf) | | [Turnkey Key Management System](https://www.turnkey.com/) | Jun 2026 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-06-turnkey-keymanagementsystem-securityreview.pdf) | | [Persona Identities Claims Verification](https://withpersona.com/) | May 2026 | 3 | | [🔖](https://github.com/trailofbits/publications/blob/master/reviews/2026-05-personaidentities-claimsverification-securityreview.pdf) | | [PyPI Warehouse](https://warehouse.pypa.io/) | Apr 2026 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2026-04-pypi-warehouse-securityreview.pdf) | | [Propeller Heads Turbine Front End and SDK](https://propellerheads.xyz/) | Mar 2026 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-03-propellerheads-turbinefrontendsdk-securityreview.pdf) | | [Propeller Heads Turbine](https://propellerheads.xyz/) | Mar 2026 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-03-propellerheads-turbine-securityreview.pdf) | | [Zoo Text-to-CAD Platform](https://zoo.dev/) | Mar 2026 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-03-Zoo-TextToCad-security-review.pdf) | | [iVerify](https://iverify.io/) | Jun 2026 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-06-iverify-securityreview.pdf) | | [X XChat](https://x.com/) | Oct 2025 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-10-x-xchat-securityreview.pdf) | | [Edera Runtime Container](https://edera.dev/) | Oct 2025 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-11-edera-container-runtime-securityreview.pdf) | | [Meta WhatsApp Private Processing](https://www.meta.com/whatsapp/) | Aug 2025 | 12 | [WhatsApp](https://blog.whatsapp.com/get-the-tone-of-your-message-right-with-private-writing-help), [Trail of Bits](https://blog.trailofbits.com/2026/04/07/what-we-learned-about-tee-security-from-auditing-whatsapps-private-inference/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-08-meta-whatsapp-privateprocessing-securityreview.pdf) | | [Discord E2EE WebAssembly](https://discord.com/) | Jun 2025 | 3 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-06-discord-e2eewebassembly-securityreview.pdf) | | [libVLC](https://images.videolan.org/vlc/libvlc.html) | May 2025 | 5 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-05-libvlc-securityreview.pdf) | | [NATS Server](https://nats.io/) | Feb 2025 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-04-ostif-nats-securityreview.pdf) | | [Istio Ztunnel](https://istio.io/) | Dec 2024 | 2 | [OSTIF](https://ostif.org/istio-ztunnel-audit-complete/), [Istio](https://istio.io/latest/blog/2025/ztunnel-security-assessment/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-12-istio-ztunnel-securityreview.pdf) | | [RubyGems.org](https://www.rubygems.org) | Dec 2024 | 5 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-12-rubycentral-rubygemsorg-securityreview.pdf) | | [Kraken Wallet In-App Browser](https://www.kraken.com/wallet) | Nov 2024 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-11-kraken-wallet-in-app-browser-securityreview.pdf) | | [Kraken Wallet iCloud Backup](https://www.kraken.com/wallet) | Sep 2024 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-09-kraken-mobile-wallet-icloud-backup-securityreview.pdf) | | [Hugging Face Gradio](https://huggingface.co/gradio) | Jul 2024 | 4 | [Hugging Face](https://huggingface.co/blog/gradio-5-security), [Trail of Bits](https://blog.trailofbits.com/2024/10/10/auditing-gradio-5-hugging-faces-ml-gui-framework/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-10-huggingface-gradio-securityreview.pdf) | | [Zoo KittyCAD](https://zoo.dev/) | Jun 2024 | 4.6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-06-zoo-kittycad-securityreview.pdf) | | [Polygon Labs Iden3 Circuits](https://polygon.technology/) | May 2024 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-05-polygonlabs-iden3circuits-securityreview.pdf) | | [Kraken Mobile Wallet](https://www.kraken.com/wallet) | Jan 2024 | 7 | [Kraken](https://blog.kraken.com/product/kraken-wallet/kraken-wallet-security)| [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-1-kraken-mobile-wallet-securityreview.pdf) | | [Eclipse Temurin](https://adoptium.net/temurin/) | Dec 2023 | 4 | [Response](https://adoptium.net/pdf/temurin-audit-response.pdf), [OSTIF](https://ostif.org/temurin-audit-complete/), [Eclipse Foundation](https://adoptium.net/blog/2024/06/external_audit) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-12-eclipse-temurin-securityreview.pdf) | | [Arch Linux Pacman](https://archlinux.org/pacman/) | Dec 2023 | 2 | [OTF](https://www.opentech.fund/security-safety-audits/arch-linuxs-pacman-package-manager-security-audit/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-12-pacman-securityreview.pdf) | | [cURL HTTP3](https://curl.se/) | Dec 2023 | 4 | [OSTIF](https://ostif.org/curl-audit-complete/), [Daniel Stenberg](https://daniel.haxx.se/blog/2024/02/23/curl-http-3-security-audit/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-12-curl-http3-securityreview.pdf) | | [Lisk SDK 6.1 modules](https://lisk.com/) | Sep 2023 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-09-lisksdk-securityreview.pdf) | | [OpenSSL](https://www.openssl.org/) | Sep 2023 | 9 | [OSTIF](https://ostif.org/openssl-audit-complete/), [OpenSSL](https://www.openssl.org/blog/blog/2024/05/02/ostif/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-09-openssl-securityreview.pdf) | | [PyPI Warehouse](https://warehouse.pypa.io/) | Sep 2023 | 10 | [PyPI](https://blog.pypi.org/posts/2023-11-14-1-pypi-completes-first-security-audit/), [Trail of Bits](https://blog.trailofbits.com/2023/11/14/our-audit-of-pypi/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-09-pypi-warehouse-securityreview.pdf) | | [wasmCloud](https://wasmcloud.com/) | Sep 2023 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-09-wasmCloud-securityreview.pdf) | | [Worldcoin](https://worldcoin.org/) | Aug 2023 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-08-worldcoin-orb-securityreview.pdf) | | [Homebrew](https://brew.sh) | Aug 2023 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-08-28-homebrew-securityreview.pdf) | | [DigitalOcean OIDC](https://www.digitalocean.com/) | Aug 2023 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-08-digitalocean-oidc-securityreview.pdf) | | [Flux](https://fluxcd.io) | Aug 2023 | 4 | [OSTIF](https://ostif.org/?p=3065&preview=true), [Flux](https://fluxcd.io/blog/2023/11/flux-security-audit/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-08-flux-securityreview.pdf) | | [Lisk SDK](https://lisk.com/) | Jul 2023 | 30 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-07-liskv4.0-securityreview.pdf) | | [DragonFly2](https://d7y.io/) | Jul 2023 | 4 | [Dragonfly](https://d7y.io/blog), [OSTIF](https://ostif.org/dragonfly-audit/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-07-dragonfly2-securityreview.pdf) | | [Eclipse JKube](https://eclipse.dev/jkube/) | May 2023 | 5 | [OSTIF](https://ostif.org/jkube-audit/), [Eclipse](https://blogs.eclipse.org/post/mika%C3%ABl-barbero/eclipse-foundation-publishes-results-eclipse-jkube-security-audit) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-05-eclipse-jkube-securityreview.pdf) | | [Chainflip](https://chainflip.io/) | Apr 2023 | 12 | [Chainflip](https://blog.chainflip.io/trail-of-bits-security-audit/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-04-chainflip-securityreview.pdf) | | [Eclipse Mosquitto](https://mosquitto.org/) | Mar 2023 | 4 | [OSTIF](https://ostif.org/mosquitto-security-audit/), [Eclipse](https://blogs.eclipse.org/post/mika%C3%ABl-barbero/eclipse-mosquitto-security-audit-has-been-completed) | [📛](https://github.com/trailofbits/publications/blob/master/reviews/2023-02-eclipse-mosquitto-lightweight-threatmodel.pdf)[📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-03-eclipse-mosquitto-securityreview.pdf) | | [Eclipse Jetty](https://eclipse.dev/jetty/) | Mar 2023 | 6 | [Jetty](http://webtide.com/security-audit-with-trail-of-bits/), [Eclipse](https://blogs.eclipse.org/post/mika%C3%ABl-barbero/eclipse-jetty-security-audit-has-been-completed) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-03-eclipse-jetty-securityreview.pdf) | | [Spool Platform](https://www.spool.fi/) | Mar 2023 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-03-spool-platformv2-securityreview.pdf) | | [Redpanda Platform](https://redpanda.com/) | Jan 2023 | 4 | | | | [Injective Labs Options Market](https://injective.com/) | Jan 2023 | 4 | | | | [OpenVPN3](https://openvpn.net/) | Jan 2023 | 6 | | | | [OpenVPN2](https://openvpn.net/) | Dec 2022 | 4 | [OpenVPN](https://openvpn.net/blog/trail-of-bits/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-12-openvpn-openvpn2-securityreview.pdf) | | [OpenArchive Save (Android)](https://open-archive.org/) | Dec 2022 | 1 |[OpenArchive Save](https://www.opentech.fund/results/security-safety-audits/openarchive-save-android-ios/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-12-openarchivesaveandroid-securityreview.pdf) | | [Enclave Markets](https://www.enclave.market/) | Nov 2022 | 9 | | | | [Fiat Ramps](https://cashero.com/) | Nov 2022 | 4 | | | | [cURL](https://curl.se/) | Oct 2022 | 9.5 | [OSTIF](https://ostif.org/the-ostif-audit-of-curl-with-trail-of-bits-is-complete/), [Daniel Stenberg](https://daniel.haxx.se/blog/2022/12/21/the-2022-curl-security-audit/). [Trail of Bits](https://blog.trailofbits.com/2022/12/22/curl-security-audit-threat-model/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-12-curl-securityreview.pdf)[📛](https://github.com/trailofbits/publications/blob/master/reviews/2022-12-curl-threatmodel.pdf) | | [CloudEvents](https://cloudevents.io/) | Oct 2022 | 4 | [OSTIF](https://ostif.org/results-of-the-cloudevents-security-assessment/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/CloudEvents.pdf) | | [OpenArchive Save (iOS)](https://open-archive.org/) | Oct 2022 | 1.2 |[OpenArchive Save](https://www.opentech.fund/results/security-safety-audits/openarchive-save-android-ios/) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-10-openarchivesaveios-securityreview.pdf) | | [AlphaSOC API](https://alphasoc.com/) | Sep 2022 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-09-alphasoc-alphasocapi-securityreview.pdf) | | [Consul Enterprise](https://www.hashicorp.com/products/consul) | Sep 2022 | 6 | | | | [snarkVM](https://www.aleo.org/) | Sep 2022 | 12 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-09-aleosystems-snarkvm-securityreview.pdf) | | [Hashicorp Boundary](https://www.hashicorp.com/) | Jul 2022 | 6 | | | | [Skiff](https://skiff.com/) | Jul 2022 | 6 | | | [Terraform Cloud](https://www.hashicorp.com/) | Jun 2022 | 6 | | | | [Datadog](https://www.datadoghq.com/) | May 2022 | 6 | | | | [MATTR](https://mattr.global/) | May 2022 | 4 | | | | [ArmorLock](https://www.westerndigital.com/) | Apr 2022 | 6 | | | | [DigitalOcean Function](https://www.digitalocean.com/) | Apr 2022 | 4 | | | | [Auvik Collector](https://www.auvik.com/system-security/) | Apr 2022 | 8 | | | | [Fuchsia Platform](https://fuchsia.dev/) | Mar 2022 | 8 | | | [Optimus ROM](https://www.westerndigital.com/) | Jan 2022 | 4 | | | | [BitcoinBeach](https://galoy.io/) | Mar 2022 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Galoy.pdf) | | [osquery](https://osquery.io/) | Jan 2022 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/osquery.pdf) | | [Redjack](https://www.redjack.com/) | Dec 2021 | 2 | | | [DigitalOcean Cloud](http://cloud.digitalocean.com/) | Nov 2021 | 12 | | | [SpruceID](https://tezos.foundation/) | Oct 2021 | 12 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/SpruceID.pdf) | | [Doppler](https://www.doppler.com/) | Sep 2021 | 4 | | | [Datadog Agent](https://www.datadoghq.com/) | Aug 2021 | 8 | | | [Appian](https://appian.com/) | Jun 2021 | 4 | | | | [Cashero-2.0](https://www.cashero.com/) | Jun 2021 | 4 | | | | [Orbit](https://fleetdm.com/) | Apr 2021 | 1 | | | | [VGS Proxy](https://www.verygoodsecurity.com/) | Apr 2021 | 4 | | | | [Skiff](https://www.skiff.org/) | Feb 2021 | 4 | | | | [CircleCI Server 3.0](https://circleci.com/) | Jan 2021 | 6 | [Penetration testing at CircleCI](https://circleci.com/blog/penetration-testing-at-circleci/) | | [BitMEX](https://www.bitmex.com/) | Jan 2021 | 4 | | | | [SecureDrop](https://freedom.press/) | Dec 2020 | 8 | [2nd audit of SecureDrop Workstation](https://securedrop.org/news/second-independent-audit-of-securedrop-workstation-completed/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/SecureDropWorkstation.pdf) | | [Citizen Browser](https://themarkup.org/) | Dec 2020 | 0.43 | [How We Built a Facebook Inspector](https://themarkup.org/citizen-browser/2021/01/05/how-we-built-a-facebook-inspector)| | [Ren](https://renproject.io/) | Aug 2020 | 4 | [Aug Development Update](https://medium.com/@loong/4ce9bb0fb98b) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/renvm.pdf) | | [Hey.com](https://www.hey.com/) | Jun 2020 | 1 | [Serious Security](https://www.hey.com/security/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Hey.pdf) | | [Azure Sphere](https://azure.microsoft.com/en-us/services/azure-sphere/) | Jun 2020 | 12 | [Azure Sphere 20.07 Security Enhancements](https://techcommunity.microsoft.com/t5/internet-of-things/azure-sphere-20-07-security-enhancements/ba-p/1548973) | | [Zoom](https://zoom.us/) | May 2020 | 9 | [90 Days Done, What's Next for Zoom](https://blog.zoom.us/ceo-report-90-days-done-whats-next-for-zoom/) | | [Secure Transport](https://www.westerndigital.com/) | Apr 2020 | 4 | | | [ZeroTier 2.0](https://www.zerotier.com/) | Mar 2020 | 2 | [ZeroTier](https://mobile.twitter.com/zerotier/status/1314343535303446531) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/ZeroTierProtocol.pdf) | | [Voatz](https://voatz.com/) | Feb 2020 | 12 | [Voatz](https://blog.voatz.com/?p=1287), [Tusk](https://mobilevoting.org/2020/03/a-note-on-security/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/voatz-securityreview.pdf)[📛](https://github.com/trailofbits/publications/blob/master/reviews/voatz-threatmodel.pdf) | | [Vault](https://www.hashicorp.com/products/vault/) | Feb 2020 | 12 | | | [Voice](https://block.one/) | Jan 2020 | 4 | | | [Azure Sphere](https://azure.microsoft.com/en-us/services/azure-sphere/) | Jun 2019 | 12 | | | | [zlib](https://www.zlib.net/) | Sep 2016 | 1 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/zlib.pdf) | ### Cloud-Native Reviews | Product | Date | Level of
Effort | Announcement | Report | | --- | --: | :-: | --- | :-: | | [KEDA](https://keda.sh/) | Dec 2022 | 6 | [OSTIF](https://ostif.org/our-audit-of-kubernetes-event-driven-autoscaling-keda-is-complete/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-01-keda-securityreview.pdf) | | [Terraform Enterprise](https://developer.hashicorp.com/terraform/enterprise) | Nov 2022 | 6 | | | | [Nomad Enterprise](https://www.nomadproject.io/) | Nov 2022 | 6 | | | | [HashiCorp Cloud](https://cloud.hashicorp.com/) | Jun 2022 | 9 | | | [Tekton](https://tekton.dev/) | Mar 2022 | 4 | [Tekton Security Review Completed](https://cd.foundation/blog/2022/08/26/tekton-security-review-completed/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Tekton.pdf) | | [Linkerd](https://linkerd.io/) | Feb 2022 | 4 | | [📛](https://github.com/trailofbits/publications/blob/master/reviews/Linkerd-threatmodel.pdf)[📄](https://github.com/trailofbits/publications/blob/master/reviews/Linkerd-securityreview.pdf)[✅](https://github.com/trailofbits/publications/blob/master/reviews/Linkerd-fixreview.pdf) | [CoreDNS](https://coredns.io/) | Jan 2022 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/CoreDNS.pdf) | [Terraform Enterprise](https://www.terraform.io/) | Nov 2021 | 6 | | | [Nomad Enterprise](https://www.nomadproject.io/) | Nov 2021 | 6 | | | [Consul Enterprise](https://www.consul.io/) | Oct 2021 | 6 | | | [Vault Enterprise](https://www.vaultproject.io/) | Oct 2021 | 6 | | | [HashiCorp Cloud](https://cloud.hashicorp.com/) | Jun 2021 | 8 | | | [Argo](https://argoproj.github.io/) | Mar 2021 | 4 | | [📛](https://github.com/trailofbits/publications/blob/master/reviews/argo-threatmodel.pdf)[📄](https://github.com/trailofbits/publications/blob/master/reviews/argo-securityreview.pdf) | | [Terraform Cloud](https://www.terraform.io/cloud) | Jan 2021 | 6 | | | [Consul](https://www.consul.io/) | Oct 2020 | 10 | | | [Nomad](https://www.nomadproject.io/) | Aug 2020 | 6 | | | [Helm](https://helm.sh/) | Aug 2020 | 4 | [Helm 2nd Security Audit](https://helm.sh/blog/helm-2nd-security-audit/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Helm.pdf) | | [Terraform](https://www.hashicorp.com/products/terraform/) | Mar 2020 | 6 | | | [OPA](https://github.com/open-policy-agent/gatekeeper) | Mar 2020 | 2 | [Open Policy Agent (OPA) Graduation Proposal](https://github.com/cncf/toc/blob/main/proposals/graduation/opa.md) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/OPAGatekeeper.pdf) | | [etcd](https://etcd.io/) | Jan 2020 | 4 | [CNCF](https://www.cncf.io/blog/2020/08/05/etcd-security-audit/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/etcd.pdf) | | [Rook](https://github.com/rook/rook/tree/release-1.1) | Dec 2019 | 2 | [CNCF](https://www.cncf.io/announcements/2020/10/07/cloud-native-computing-foundation-announces-rook-graduation/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/rook.pdf) | | [Kubernetes](https://kubernetes.io/) | May 2019 | 12 | [Google](https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-security-audit-what-gke-and-anthos-users-need-to-know), [CNCF](https://www.helpnetsecurity.com/2019/08/12/kubernetes-security-matures/) | [📛](https://github.com/trailofbits/audit-kubernetes/blob/master/reports/Kubernetes%20Threat%20Model.pdf)[📄](https://github.com/trailofbits/audit-kubernetes/blob/master/reports/Kubernetes%20Security%20Review.pdf)[📰](https://github.com/trailofbits/audit-kubernetes/blob/master/reports/Kubernetes%20White%20Paper.pdf) ### Invariant Testing and Development Engagements | Product | Date | Level of
Effort | Announcement | Report | Public Suite | | ---| --: | :-: | --- | :-: | --- | | [Panoptic](https://panoptic.xyz/) | May 2024 | 9 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-05-panoptic-liquidation-engine-invariant-development.pdf) | | | [Curvance](https://www.curvance.com/) | Mar 2024 | 5 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-03-curvance-invariant-development.pdf) | [Public invariants](https://github.com/curvance/Curvance-CantinaCompetition/tree/CodeFAQAndAdjustments/tests/fuzzing) | ### Blockchain Reviews #### Wallet Reviews | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | [Gemini Smart Wallet](https://www.gemini.com/wallet/) | Aug 2025 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-08-gemini-smartwallet-securityreview.pdf)[🔖](https://github.com/trailofbits/publications/blob/master/reviews/2025-08-gemini-smartwallet-letterofattestation.pdf) | | [Otim Smart Wallet](https://otim.com/) | Mar 2025 | 3 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-03-otim-smart-wallet-securityreview.pdf) | | [dappOS v2 wallet](https://dappos.com/) | Jul 2023 | 3 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-07-dappos-securityreview.pdf) | | [WalletConnect v2.0](https://walletconnect.com/) | Mar 2023 | 4 | [WalletConnect](https://medium.com/walletconnect/walletconnect-v2-0s-independent-security-audit-by-trail-of-bits-e8e59d11e517) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-03-walletconnectv2-securityreview.pdf) | | [Phantom Wallet](https://phantom.app/) | Nov 2022 | 2 | | | | [GameStop iOS Web Wallet](https://www.gamestop.com/) | Nov 2022 | 1 | | | | [GameStop Wallet](https://www.gamestop.com/) | Mar 2022 | 2 | [GameStop wallet](https://investor.gamestop.com/news-releases/news-release-details/gamestop-launches-wallet-cryptocurrencies-and-nfts) | | | [RAILGUN](https://righttoprivacy.foundation/) | Feb 2022 | 4 | | | | [Casper Web Wallet](https://casperlabs.io/) | Jul 2021 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/CasperLedger.pdf) | | [Argent](https://www.argent.xyz/) | Aug 2020 | 4 | | | | [Magma](https://magmawallet.com/) | Jun 2020 | 1 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/MagmaWallet.pdf) | | [Dharma Wallet](https://www.dharma.io/) | Oct 2019 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/dharma-smartwallet.pdf) | | [ZecWallet](https://github.com/ZcashFoundation/zecwallet) | Apr 2019 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/zecwallet.pdf) | | [Web3](https://web3.foundation/) | Mar 2018 | 2 | [W3F and TOB hardware wallet guidance](https://medium.com/web3foundation/w3f-and-trail-of-bits-release-guidance-for-secure-use-of-hardware-wallets-b12f14182db7) | [💬](https://blog.trailofbits.com/2018/11/27/10-rules-for-the-secure-use-of-cryptocurrency-hardware-wallets/)| #### Algorand | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | [Folks Finance Protocol](https://folks.finance/) | Nov 2022 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-11-folksfinance-securityreview.pdf) | | [wXTZ](https://www.stakerdao.com/) | Nov 2020 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/wXTZ.pdf) | | [wALGO](https://www.stakerdao.com/) | Nov 2020 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/wALGO.pdf) | | [Meld Gold](https://meld.gold/) | Jul 2020 | 2 | | | | [Pixel](https://www.algorand.com/) | Dec 2019 | 4 | | | | [Algorand](https://www.algorand.com/) | Mar 2019 | 14 | [Success and momentum of Algorand](https://medium.com/algorand/success-and-momentum-of-algorand-the-platform-technology-for-the-borderless-economy-35b22cae63c6) | | #### Avalanche | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | [Ava Labs AvalancheGo](https://www.avalabs.org/) | Aug 2025 | 10 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-08-ava-labs-avalanchego-securityreview.pdf)| | [Alkimiya Silica V2](https://alkimiya.io/) | Jun 2022 | 6 | | | | [Ava Labs](https://www.avalabs.org/) | Apr 2022 | 8 | | | | [Flare Network](https://flare.xyz/) | Mar 2021 | 8 | | | #### Bitcoin & Derivatives | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | [ZetaChain Bitcoin Inscriptions](https://www.zetachain.com/) | Jan 2025 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-01-zetachain-bitcoin-inscriptions-securityreview.pdf) | | [Nomic](https://www.nomic.io/) | Nov 2024 | 10 | [Nomic](https://blog.nomic.io/security-audit-trail-of-bits-8ae87ce19bf0) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-11-nomic-securityreview.pdf) | | [STAS SDK](https://www.taal.com/) | Oct 2021 | 4 | | | | [STAS-JS SDK](https://www.taal.com/#) | Sep 2021 | 4 | | | | [Bitcoin SV](https://nchain.com/) | Jan 2021 | 6 | | | [Zcoin](https://zcoin.io/) | Jul 2020 | 2 | [Zcoin](https://zcoin.io/lelantus-cryptographic-library-audit-results/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/zcoin-lelantus-summary.pdf) | | [Zcash](https://electriccoin.co/) | Apr 2020 | 3 | [Electric Coin Co.](https://electriccoin.co/blog/heartwood-security-assessment-turns-up-no-major-issues/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Zcash2.pdf) | | [Zcash](https://electriccoin.co/) | Nov 2019 | 6 | [NU3, Blossom, and Sapling security reviews](https://electriccoin.co/blog/security-assessments-nu3-specifications-blossom-implementation-and-sapling-documentation/)| [📄](https://github.com/trailofbits/publications/blob/master/reviews/Zcash.pdf) | | [Zcash](https://electriccoin.co/) | Nov 2019 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/ZcashWP.pdf) | | [Paymail Protocol](https://nchain.com/en/) | Nov 2019 | 7 | | | | [Simple Ledger](https://simpleledger.cash/) | Oct 2019 | 3 | | | | [Bitcoin SV](https://bitcoinsv.io/) | Nov 2018 | 12 | | | [RSKj](https://www.rsk.co/) | Nov 2017 | 6 | [RSK security audit results](https://www.rsk.co/noticia/rsk-security-audit-results/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/RSKj.pdf) | #### Ethereum/EVM | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | [Arcus Labs Rootchain v5 Smart Contracts](https://arcus.xyz) | Jun 2026 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-06-arcuslabs-rootchain-securityreview.pdf) | | [Kiln Lagoon Vault Diff Review](https://docs.lagoon.finance/resources/audits) | May 2026 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-05-kiln-lagoonvaultdiffreview-securityreview.pdf) | | [Franklin Templeton BenjiSwap Differential Review](https://digitalassets.franklintempleton.com/benji/) | Apr 2026 | 1.2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-04-franklintempleton-benjiswapdifferentialreview-securityreview.pdf) | | [Gensyn Buyback-and-Burn Vault](https://www.gensyn.ai/) | Apr 2026 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-04-gensyn-buyback-and-burn-vault-securityreview.pdf) | | [Gensyn Bridged Token](https://www.gensyn.ai/) | Apr 2026 | 0.2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2026-04-gensyn-bridged-gensyn-token-securityreview.pdf) | | [Gensyn ERC-20 Token](https://www.gensyn.ai/) | Sep 2025 | 0.2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2026-04-gensyn-erc-20-token-securityreview.pdf) | | [Gensyn Delphi Dynamic Paramutuel Markets](https://app.delphi.fyi/) | Apr 2026 | 3.4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-04-gensyn-delphidynamicparamutuelmarkets-securityreview.pdf) | | [Shape TokenLock](https://shape.network/audits) | Mar 2026 | 0.4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-03-shape-tokenlock-securityreview.pdf) | | [Aave v4](https://aave.com) | Feb 2026 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-02-aave-v4-securityreview.pdf) | | [VeChain VeChainThor Hayabusa Upgrade](https://github.com/vechain/thor/releases/tag/v2.3.0) | Oct 2025 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-10-vechain-vechainthorhayabusaupgrade-securityreview.pdf) | | [Franklin Templeton BenjiSwap Contract](https://www.franklintempleton.com/about-us/our-teams/specialist-investment-managers/digital-assets/digital-assets-technology) | Oct 2025 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-10-franklintempleton-benjiswapcontract-securityreview.pdf) | | [Radius Technology EVMAuth](https://evmauth.io/) | Oct 2025 | 1.2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-10-radiustechnology-evmauth-securityreview.pdf) | | [Shape Buyback Contract](https://shape.network/) | Sep 2025 | 0.4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-09-shapenetwork-buybackcontract-securityreview.pdf) | | [Starkware StarkEx Diff](https://starkware.co/starkex/) | Aug 2025 | 0.2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-08-starkware-starkex-diff-review-securityreview.pdf) | | [Shape Token Contract](https://shape.network/) | May 2025 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-05-shapenetwork-token-securityreview.pdf) | | [CAP Labs Covered Agent Protocol](https://cap.app/) | May 2025 | 9 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-05-caplabs-coveredagentprotocol-securityreview.pdf) | | [Fabric Labs Zipper Protocol](https://zipper.trade/) | May 2025 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-05-fabriclabs-zipperprotocol-securityreview.pdf) | | [Lagrange LAToken](https://www.lagrange.dev/) | Apr 2025 | 3 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-04-lagrange-latoken-securityreview.pdf) | | [Serai DEX](https://serai.exchange/) | Apr 2025 | 3 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-04-serai-dex-security-review.pdf) | | [Automata](https://www.ata.network/) | Feb 2025 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-02-automata-dcap-attestation-onchain-pccs-securityreview.pdf) | | [Bunni v2](https://bunni.pro/) | Jan 2025 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-01-bacon-labs-bunniv2-securityreview.pdf) | | [Everstake Staking](https://everstake.one/) | Jan 2025 | 3 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-1-everstake-ethereum-staking-protocol-securityreview.pdf) | | [Parabol Smart Contracts Updates](https://parabol.fi/) | Jan 2025 | 0.4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-01-parabollabs-protocolcontractsupdates-securityreview.pdf) | | [BeethovenX Sonic Staking](https://beets.fi/) | Jan 2025 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-01-beethovenx-sonicstaking-securityreview.pdf) | | [Balancer v3](https://balancer.fi/) | Dec 2024 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-12-balancer-v3-securityreview.pdf) | | [ULTI](https://www.ulti.org/) | Dec 2024 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-12-ULTI-securityreview.pdf) | | [EthStaker Deposit CLI](https://ethstaker.cc/) | Dec 2024 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-12-ethstaker-depositcli-securityreview.pdf) | | [Plume](https://www.plumenetwork.xyz/) | Nov 2024 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-11-plume-securityreview.pdf) | | [Treehouse tETH Protocol](https://www.treehouse.finance/) | Sep 2024 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-09-treehouse-finance-teth-extension-securityreview.pdf) | | [Elixir Protocol](https://www.elixir.xyz/) | Aug 2024 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-08-elixir-technologies-ltd-elixir-protocol-securityreview.pdf) | | [Onchain Pass](https://www.onchain.ro/) | Aug 2024 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-08-onchain-pass-app-contracts-securityreview.pdf) | | [Taraxa Ficus Bridge](https://docs.taraxa.io/) | Jul 2024 | 1.6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-07-taraxa-bridge-smart-contracts-v2-securityreview.pdf) | | [Devcon Auction Raffle](https://raffle.devcon.org/) | Jun 2024 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-06-ethereum-foundation-devcon-auction-raffle-securityreview.pdf) | | [Aladdin f(x) Oracle](https://fx.aladdin.club/) | Jun 2024 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-06-aladdinfx-oracle-securityreview.pdf) | | [AiLayer 6079 Contracts](https://6079.ai) | May 2024 | 3 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-05-ailayerlabs-6079smartcontracts-securityreview.pdf) | | [Hydrogen Rover Protocol](https://roverstaking.com/) | May 2024 | 0.45 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-05-hydrogenlabs-securityreview.pdf) | | [Lisk Smart Contracts](https://lisk.com/) | May 2024 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-05-lisksmartcontracts-securityreview.pdf) | | [Parabol Smart Contracts](https://parabol.fi/) | May 2024 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-05-parabollabs-protocolcontracts-securityreview.pdf) | | [Wonderland Prophet](https://defi.sucks/) | May 2024 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-05-wonderland-prophet-securityreview.pdf) | | [SEDA Chain Token Migration](https://www.seda.xyz/) | Mar 2024 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-03-seda-chaintokenmigration-securityreview.pdf) | | [Lisk Smart Contracts](https://lisk.com/) | Mar 2024 | 4.6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-03-lisksmartcontracts-securityreview.pdf) | | [Bondex Smart Contracts](https://bondex.app/) | Mar 2024 | 0.6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-03-bondexecosystem-loa.pdf) | | [Aladdin f(x) Protocol](https://fx.aladdin.club/) | Mar 2024 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-03-aladdinfxprotocol-securityreview.pdf) | | [Puffer Finance Contracts](https://www.puffer.fi/) | Mar 2024 | 1.2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-03-pufferfinance-securityreview.pdf) | | [Intuition](https://www.intuition.systems) | Mar 2024 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-03-intuition-smart-contracts-securityreview.pdf) | | [Helios Global](https://www.helios.eco/) | Feb 2024 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-02-heliosglobal-securityreview.pdf) | | [ScopeLift Stealth Addresses](https://scopelift.co/) | Feb 2024 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-02-scopelift-securityreview.pdf) | | [MetaLayer Blast](https://blast.io/en) | Jan 2024 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-01-metalayerblast-securityreview.pdf) | | [Unibot Router](https://unibot.app/) | Dec 2023 | 1.6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-12-unibot-securityreview.pdf) | | [Acronym Foundation](https://acronymfoundation.org/) | Dec 2023 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-12-acronym-foundation-securityreview.pdf) | | [Pyth Entropy](https://docs.pyth.network/entropy) | Dec 2023 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2024-01-pyth-entropy-securityreview.pdf) | | [Immutable Bridge](https://www.immutable.com/) | Nov 2023 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-11-immutable-zkevmbridgecontracts-securityreview.pdf) | | [Salty.IO Protocol](https://docs.salty.io/) | Oct 2023 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-10-saltyio-securityreview.pdf) | | [Spiko Smart Contracts](https://www.spiko.xyz/) | Oct 2023 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-10-spiko-securityreview.pdf) | | [Hyperlane v3](https://www.hyperlane.xyz/) | Sep 2023 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-09-hyperlane-securityreview.pdf) | | [Elixir Contracts](https://elixir.finance/) | Sep 2023 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-09-elixir-securityreview.pdf) | | [NZDD token](https://easycrypto.com/) | Aug 2023 | 0.6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-08-easycrypto-securityreview.pdf) | | [Immutable](https://www.immutable.com/) | Aug 2023 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-08-immutable-securityreview.pdf) | | [Sandclock](https://www.sandclock.org/) | Jul 2023 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-07-sandclock-securityreview.pdf) | | [Arcade](https://www.arcade.xyz/) | Jul 2023 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-07-arcade-securityreview.pdf) | | [Nested Tetris/HyVM](https://nested.fi/) | Jun 2023 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-06-nestedfinance-tetrishyvm-securityreview.pdf) | | [Franklin Templeton](https://www.franklintempleton.com/) | May 2023 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-05-franklintempleton-moneymarket-securityreview.pdf) | | [Prysm](https://prysmaticlabs.com/) | Apr 2023 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-04-prysm-securityreview.pdf) | | [Ajna Protocol](https://www.ajna.finance/) | Apr 2023 | 12 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-04-ajnalabs-securityreview.pdf) | | [Raft](https://docs.tempus.finance/products/raft) | Apr 2023 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-04-tempus-raft-securityreview.pdf) | | [MYSO v2](https://www.myso.finance) | Apr 2023 | 2 | [MYSO](https://twitter.com/MysoFinance/status/1649191996978786305) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-04-mysoloans-securityreview.pdf) | | [Smardex AMM](https://www.smardex.io/) | Apr 2023 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-04-smardexamm-realestateexecutives-securityreview.pdf) | | [Waymont](https://www.waymont.co/) | Mar 2023 | 1 | | | | [Atlendis](https://www.atlendis.io/) | Mar 2023 | 6 | [Atlendis](https://www.atlendis.io/blog/Atlendis-V2-Trail-of-Bits-Audit) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-03-atlendis-atlendissmartcontracts-securityreview.pdf) | | [Primitive Hyper](https://primitive.xyz/) | Mar 2023 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-03-primitive-securityreview.pdf) | | [Succinct Light Client](https://www.succinct.xyz/) | Feb 2023 | 8 | [Succinct](https://blog.succinct.xyz/blog/telepathy) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-02-succinct-securityreview.pdf) | | [Nested Finance](https://nested.fi/) | Feb 2023 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-02-nestedfinance-smartcontracts-securityreview.pdf) | | [Polygon Edge](https://polygon.technology/) | Jan 2023 | 6 | | | | [Optimism](https://www.optimism.io/) | Dec 2022 | 8 | | | | [Paxos PayPal PYUSD](https://paxos.com/pyusd/) | Dec 2022 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-12-paxos-paypal-pyusd-securityreview.pdf) | | [GSquared](https://docs.gro.xyz/gro-docs/) | Oct 2022 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2022-10-GSquared-securityreview.pdf)[✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-10-GSquared-fixreview.pdf) | | [Meson Protocol](https://docs.meson.fi/references/audit-reports) | Oct 2022 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/MesonProtocol.pdf)[✅](https://github.com/trailofbits/publications/blob/master/reviews/MesonProtocolFixReview.pdf) | | [Managed Pools](https://balancer.fi/) | Oct 2022 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2022-10-balancerlabs-managedpoolsmartcontracts-securityreview.pdf) | | [Ondo](https://ondo.finance/) | Oct 2022 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2022-10-shimacapital-ondo-securityreview.pdf)[✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-10-shimacapital-ondo-fixreview.pdf) | | [ Maple Protocol v2](https://www.maple.finance/) | Sep 2022 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-09-maplefinance-mapleprotocolv2-securityreview.pdf) | | [Increment Protocol](https://increment.finance/) | Sep 2022 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2022-09-incrementprotocol-securityreview.pdf)[✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-09-incrementprotocol-fixreview.pdf) | | [Subspace Farmer](https://subspace.network/) | Sep 2022 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2022-09-subspacenetwork-subspacenetworkdesktopfarmer-securityreview.pdf)[✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-09-subspacenetwork-subspacenetworkdesktopfarmer-fixreview.pdf)| | [Optimism](https://www.optimism.io/) | Sep 2022 | 16 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2022-11-optimism-securityreview.pdf) | | [Nayms](https://nayms.com/) | Sep 2022 | 6 | | | | [Aggregator](https://www.solon.network/) | Aug 2022 | 2 | | | | [The Franchiser](https://uniswap.org/) | Aug 2022 | 3 | | | | [Meson Protocol](https://docs.meson.fi/references/audit-reports) | Jul 2022 | 0.6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/MesonProtocolDesignReview.pdf) | | [ChainPort](http://chainport.io/) | Jul 2022 | 8 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-02-chainport-securityreview.pdf)[✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-02-chainport-fixreview.pdf) | | [Relay](https://thesis.co/) | Jul 2022 | 1 | | | | [Beanstalk](https://bean.money/) | Jul 2022 | 8 | [Beanstalk](https://bean.money/blog/trail-of-bits-audit-of-beanstalk-completed) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2022-07-beanstalk-securityreview.pdf)[✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-07-beanstalk-fixreview.pdf) | | [Purpose for Profit](https://x.company/) | Jul 2022 | 3 | | | | [Solon](https://www.solon.finance/) | Jul 2022 | 6 | | | | [Roll](https://tryroll.com/) | Jul 2022 | 2 | | | | [Ante Protocol](https://www.ante.finance/) | May 2022 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/AnteProtocol.pdf)[✅](https://github.com/trailofbits/publications/blob/master/reviews/AnteProtocolFixReview.pdf) | | [Sherlock](https://www.sherlock.xyz/) | Jun 2022 | 4 | | | | [FlareFinance](https://flr.finance/) | Jun 2022 | 4 | | | | [TBTv2](https://thesis.co/) | Jun 2022 | 6 | | | | [Morpho](https://www.morpho.best/) | Jun 2022 | 4 | [Morpho](https://twitter.com/morpholabs/status/1533818817918517250?s=21&t=x0tkW-pNfG0Hq7pyyVWFrg) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/MorphoLabs.pdf) | | [Relayer Contracts](https://balancer.fi/) | Jun 2022 | 2 | | | | [AuctionRaffle](https://ethereum.org/en/foundation/) | May 2022 | 2 | | | | [Seaport Protocol](https://opensea.io/) | May 2022 | 4 | [OpenSea](https://opensea.io/blog/announcements/introducing-seaport-protocol/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/SeaportProtocol.pdf) | | [Shell Protocol v2](https://shellprotocol.io/) | May 2022 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/ShellProtocolv2.pdf) | | [Optimism](https://www.optimism.io/) | Apr 2022 | 6 | | | | [NFTX](https://nftx.io/) | Apr 2022 | 4 | [NFTX](https://docs.nftx.io/smart-contracts/bug-bounty/trail-of-bits-audit) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/NFTX.pdf) | | [ReserveLending+](https://unfederalreserve.com/) | Apr 2022 | 4 | [unFederalReserve](https://unfederalreserve.medium.com/security-audit-for-reservelending-update-60b1a90a2d6) | | | [Firefly](https://dtrade.org/) | Apr 2022 | 4 | | | | [Maple Finance](https://www.maple.finance/) | Mar 2022 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-03-maplefinance-securityreview.pdf) | | [Gyroscope](https://gyro.finance/) | Mar 2022 | 6 | | | | [LooksRare](https://looksrare.org/) | Mar 2022 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/LooksRare.pdf) | | [Symbiosis](https://symbiosis.finance/) | Mar 2022 | 2 | | | | [RAILWAY](https://righttoprivacy.foundation/) | Feb 2022 | 4 | | | | [Persistence ETH2.0](https://persistence.one/) | Feb 2022 | 4 | | | | [Advanced Blockchain](https://www.advancedblockchain.com/) | Feb 2022 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/AdvancedBlockchainQ12022.pdf) | | [Perpetual Protocol V2](https://perp.com/) | Feb 2022 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/PerpetualProtocolV2.pdf) | | [Futureswap V4.1](https://www.futureswap.com/) | Feb 2022 | 4 | | | | [Firefly](https://dtrade.org/) | Feb 2022 | 8 | | | | [API3](https://api3.org/) | Feb 2022 | 8 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/API3.pdf) | | [Beethoven X](https://beets.fi/) | Feb 2022 | 1 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/BeethovenXSummary.pdf) | | [Minterest Finance](https://minterest.com/) | Jan 2022 | 6 | | | | [pSTAKE](https://persistence.one/) | Jan 2022 | 6 | | | | [Primitive](https://primitive.finance/) | Jan 2022 | 8 | [Primitive](https://twitter.com/PrimitiveFi/status/1518665248756051968) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Primitive.pdf) | | [Strips Finance](https://strips.finance/) | Jan 2022 | 8 | | | | [Cardstack](https://cardstack.com/) | Dec 2021 | 4 | | | | [Sherlock Protocol V2](https://www.sherlock.xyz/) | Dec 2021 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Sherlockv2.pdf) | | [Maple](https://www.maple.finance/) | Nov 2021 | 4 | [Maple](https://github.com/maple-labs/loan#audit-reports) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/MapleFinance.pdf) | | [Advanced Blockchain](https://www.advancedblockchain.com/) | Nov 2021 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/AdvancedBlockchainQ42021.pdf) | | [Opyn](https://www.opyn.co/) | Nov 2021 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Opyn.pdf) | | [Aave V3](https://aave.com/) | Nov 2021 | 12 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2021-11-aave-v3-securityreview.pdf) | | [Tokemak](https://www.tokemak.xyz/) | Oct 2021 | 3 | | | | [Fuji Finance](https://app.fujidao.org/#/) | Oct 2021 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/FujiProtocol.pdf) | | [V2 Vault](https://www.riskharbor.com/) | Oct 2021 | 4 | | | | [Yield V2](https://yield.is/) | Sep 2021 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/YieldV2.pdf) | | [Gro protocol](https://www.gro.xyz/) | Sep 2021 | 2 | | | | [Futureswap V4](https://www.futureswap.com/) | Sep 2021 | 6 | | | | [RocketPool](https://rocketpool.net/) | Aug 2021 | 5 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/RocketPool.pdf) | | [AlphaX](https://alphafinance.io/) | Aug 2021 | 6 | | | | [Bug Bounty Platform](https://solidified.io/) | Aug 2021 | 8 | | | | [88mph V3](https://88mph.app/) | Aug 2021 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/88mph.pdf) | | [Timeswap](https://timeswap.io/) | Jul 2021 | 2 | | | | [CompliFi](https://compli.fi/) | Jul 2021 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/CompliFi.pdf) | | [Optics](https://celo.org/) | Jul 2021 | 2 | | | | [FlareFinance](https://flr.finance/) | Jun 2021 | 4 | | | | [Abyss Lockup](https://www.allnodes.com/) | Jun 2021 | 2 | | | | [Futureswap V3](https://www.futureswap.com/) | Jun 2021 | 6 | | | | [CompliFi](https://compli.fi/) | Jun 2021 | 6 | | | | [Syndicate](https://www.syndicateprotocol.org/) | May 2021 | 4 | | | | [Opyn Gamma](https://www.opyn.co/) | May 2021 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Opyn-Gamma-Protocol.pdf) | | [Yearn v2 Vaults](https://yearn.finance/) | Apr 2021 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/YearnV2Vaults.pdf) | | [Balancer v2](https://balancer.fi/) | Apr 2021 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2021-04-balancer-balancerv2-securityreview.pdf) | | [DFX Finance](https://dfx.finance/) | Apr 2021 | 6 | | | | [Tokemak](https://www.tokemak.xyz/) | Apr 2021 | 1 | | | | [Warp Contracts](https://en.advancedblockchain.com/) | Apr 2021 | 6 |[Composable](https://composablefi.medium.com/composable-announces-the-completion-of-trail-of-bits-audit-c46bd84333de) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/AdvancedBlockchain.pdf) | | [FlareFinance](https://flr.finance/) | Apr 2021 | 3 | | | | [MC Dai](https://makerdao.com) | Mar 2021 | 6 | | | | [dForce Lending](https://dforce.network/) | Mar 2021 | 6 | | | | [Liquity Proxy Contract](https://www.liquity.org/) | Feb 2021 | 0.57 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/LiquityProxyContracts.pdf) | | [Liquity Protocol](https://www.liquity.org/) | Feb 2021 | 8 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/LiquityProtocolandStabilityPoolFinalReport.pdf)| | [RAY-DAO](https://staked.us/) | Feb 2021 | 4 | | | | [Futureswap](https://www.futureswap.com/) | Jan 2021 | 2 | | | | [Balancer V2](https://balancer.finance/) | Jan 2021 | 6 | | | | [C.R.E.A.M.](https://app.cream.finance/) | Jan 2021 | 1 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/CREAMSummary.pdf) | | [LUSD](https://www.liquity.org/) | Dec 2020 | 8 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Liquity.pdf) | | [Origin Dollar](https://www.ousd.com/) | Nov 2020 | 4 | [Origin Protocol](https://medium.com/originprotocol/origin-dollar-ousd-relaunches-to-offer-hassle-free-defi-returns-b8ee0c601dad) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/OriginDollar.pdf) | | [Zerion SDK](https://zerion.io/) | Nov 2020 | 4 | | | | [Teller Protocol](https://www.teller.finance/) | Nov 2020 | 4 | | | | [Hermez](https://iden3.io/) | Nov 2020 | 4 | [Hermez](https://blog.hermez.io/hermez-second-audit-by-trail-of-bits/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/hermez.pdf) | | [Graph Protocol](https://thegraph.com/) | Oct 2020 | 3 | | | | [OVM](https://optimism.io/) | Oct 2020 | 6 | | | | [Prysm](https://prysmaticlabs.com/) | Sep 2020 | 6 | | | | [DODO](https://dodoex.io/) | Sep 2020 | 3 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/dodo.pdf) | | [Yield Protocol](https://yield.is/Yield.pdf) | Aug 2020 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/YieldProtocol.pdf) | | [Smart Pool](https://balancer.finance/) | Aug 2020 | 1 | | | | [DeFiner](https://definer.org/) | Aug 2020 | 1 | | | | [ETH2.0 Deposit CLI](https://ethereum.org/en/) | Aug 2020 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/ETH2DepositCLI.pdf)| | [CurveDAO](https://dao.curve.fi/) | Jul 2020 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/CurveDAO.pdf) | | [Amp](https://amptoken.org/) | Jul 2020 | 3 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/amp.pdf) | | [Federated Bridge](https://www.rsk.co/) | Jul 2020 | 1 | | | | [dForce dToken](https://dforce.network/) | Jul 2020 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/dtoken.pdf) | | [Matic](https://matic.network/) | Jun 2020 | 4 | | | | [Lighthouse](https://lighthouse.sigmaprime.io/) | Jun 2020 | 4 | | | | [tBTC](https://thesis.co/) | May 2020 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/thesis-summary.pdf) | | [QTUM](https://qtum.org/en) | Apr 2020 | 0.43 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/qtum_loa.pdf) | | [Hegic](https://www.hegic.co/) | Apr 2020 | 0.43 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/hegic-summary.pdf) | | [Golem Network](https://golem.network/) | Mar 2020 | 2 | | | | [Reddit](https://www.reddit.com/community-points/) | Mar 2020 | 1 | [A New Frontier](https://www.reddit.com/community-points/) | | | [Chai](https://chai.money/) | Feb 2020 | 0.28 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/chai-loa.pdf) | | [Compound](https://compound.finance/) | Feb 2020 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/compound-governance.pdf) | | [WorkLock](https://www.nucypher.com/) | Jan 2020 | 2 | [NuCypher](https://blog.nucypher.com/worklock-security-audit/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/WorkLock-Summary.pdf) | | [Balancer](https://balancer.finance/) | Jan 2020 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/BalancerCore.pdf) | | [Curve.fi](https://compound.curve.fi/) | Jan 2020 | 1 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/curve-summary.pdf) | | [Livepeer](https://livepeer.org/) | Oct 2019 | 3 | | | | [Topo Finance](https://topo.finance/) | Oct 2019 | 4 | | | | [0x Protocol](https://0x.org/) | Oct 2019 | 10 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/0x-protocol.pdf) | | [Flexa](https://flexa.network/) | Sep 2019 | 2 | [Flexa](https://medium.com/flexa/announcing-flexa-capacity-35c62ade9522) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Flexa.pdf) | | [AZTEC Protocol](https://www.aztecprotocol.com/) | Sep 2019 | 10 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/aztec.pdf) | | [Oasis Labs](https://www.oasislabs.com/) | Sep 2019 | 13 | | | | [Aave Protocol](https://aave.com/) | Sep 2019 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/aaveprotocol.pdf) | | [MC Dai](https://makerdao.com) | Aug 2019 | 13 | [MakerDAO](https://blog.makerdao.com/mcd-security-roadmap-update-october-2019/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/mc-dai.pdf) | | [Staked](https://staked.us/) | Aug 2019 | 4 | | | | [Compound](https://compound.finance/) | Aug 2019 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/compound-3.pdf) | | [Computable](https://www.computable.io/) | Jul 2019 | 8 | [Computable](https://medium.com/computable-blog/computable-contract-audit-771e3d39ea7) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/computable.pdf) | | [Numerai](https://numer.ai/homepage) | May 2019 | 3 | [Numerai](https://medium.com/numerai/nmr2point0-66a45a9a5e70) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/numerai.pdf) | | [MerkleX](https://merklex.io/) | May 2019 | 4 | | | | [TokenCard](https://tokencard.io/) | May 2019 | 5 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/TokenCard.pdf) | | Unity Coin | Apr 2019 | 1 | | | | [Compound](https://compound.finance/) | Apr 2019 | 8 | [Compound](https://medium.com/compound-finance/compound-v2-is-live-157db0b7cfc8) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/compound-2.pdf) | | [Ocean Protocol](https://oceanprotocol.com/) | Mar 2019 | 4 | [Ocean Protocol](https://blog.oceanprotocol.com/one-protocol-one-network-many-stakeholders-8be11a020cff) | | | [UMA Project](https://umaproject.org/) | Mar 2019 | 3 | | | | [Centrifuge](https://centrifuge.io/) | Mar 2019 | 5 | | | | [Nomisma](http://nomisma.org/) | Mar 2019 | 1 | | | | [Set Protocol](https://www.setprotocol.com/) | Mar 2019 | 5 | [Set Protocol](https://medium.com/set-protocol/the-road-to-mainnet-ab4877b73066) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/setprotocol.pdf) | | [NuCypher](https://www.nucypher.com/) | Feb 2019 | 4 | [NuCypher](https://blog.nucypher.com/security-audits-round-2/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/nucypher-2.pdf) | | [AMP StableWire](https://amp.credit/) | Jan 2019 | 1 | | | | [EIP-1283](https://github.com/ethereum/EIPs/pull/1283) | Jan 2019 | 1 | [ChainSecurity](https://medium.com/chainsecurity/constantinople-security-update-3d02017747f2) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/EIP-1283.pdf) | | [Ampleforth](https://www.ampleforth.org/) | Nov 2018 | 4 | [Ampleforth](https://medium.com/ampleforth/source-code-and-security-audits-with-trail-of-bits-2b1ad4a09a31) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/ampleforth.pdf) | | [Origin Protocol](https://www.originprotocol.com/en) | Nov 2018 | 4 | [Origin Protocol](https://medium.com/originprotocol/the-results-of-our-smart-contract-audit-with-trail-of-bits-and-how-we-approach-security-at-origin-175cc1646d71) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/origin.pdf) | | [Paxos Standard](https://www.paxos.com/standard/) | Oct 2018 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/paxos.pdf) | | [Basecoin](https://www.basis.io/) | Oct 2018 | 12 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/basis.pdf) | | [Pantheon](https://pegasys.tech/) | Oct 2018 | 8 | [PegaSys](https://pegasys.tech/what-we-learned-from-auditing-our-ethereum-client/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/pantheon.pdf) | | [Compound](https://compound.finance/) | Sep 2018 | 12 | [Compound](https://medium.com/compound-finance/compound-launches-money-markets-for-ethereum-assets-f50920f04488) | | | [NuCypher](https://www.nucypher.com/) | Aug 2018 | 12 | [NuCypher](https://blog.nucypher.com/security-audits--round-1--3/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/nucypher.pdf) | | [CENTRE](https://www.centre.io/) | Jul 2018 | 4 | [CENTRE](https://medium.com/centre-blog/designing-an-upgradeable-ethereum-contract-3d850f637794) | | [Bloom](https://bloom.co/) | Jul 2018 | 1 | [Bloom](https://blog.hellobloom.io/bloom-development-update-mainnet-launch-blockchain-ux-improvements-open-source-developer-c8ddc194fe83) | | [Gemini Dollar](https://gemini.com/dollar/) | Jun 2018 | 8 | [Gemini](https://medium.com/gemini/stablecoins-understanding-counterparty-risk-241d55f0b392) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/gemini-dollar.pdf) | | [Dharma](https://dharma.io/) | May 2018 | 1 | [Dharma](https://blog.dharma.io/dharma-protocol-v1-is-live-on-mainnet-95f8ef770c2c) | | | [Golem](https://golem.network/) | Apr 2018 | 4 | [Golem](https://medium.com/golem-project/smart-contracts-audit-report-ad41fdd5085b) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/golem.pdf) | | [LivePeer](https://livepeer.org/) | Mar 2018 | 4 | [Livepeer](https://medium.com/livepeer-blog/livepeer-smart-contract-security-audit-1-results-631c4d7d98a4) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/livepeer.pdf) | | [DappHub](https://dapphub.com/) | Dec 2017 | 8 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/dapphub.pdf) | | [MakerDAO Sai](https://makerdao.com/en/) | Oct 2017 | 8 | [MakerDAO](https://medium.com/makerdao/single-collateral-dai-source-code-and-security-reviews-523e1a01a3c8) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/sai.pdf) | | [Omega One](https://dark.omega.one/) | Aug 2017 | 6 | | | #### NervOS | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | [xUDT](https://www.nervos.org/) | Jun 2021 | 2 | | | | [Nervos -RSA](https://www.nervos.org/) | Mar 2021 | 4 | | | | [Cheque Cell & ORU](https://www.nervos.org/) | Feb 2021 | 8 | | | | [Force Bridge - Solidity](https://www.nervos.org/) | Feb 2021 | 4 | | | | [Force Bridge - Rust](https://www.nervos.org/) | Feb 2021 | 3 | | | | [Nervos SUDT](https://www.nervos.org/) | Oct 2020 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/NervosSUDT.pdf) | #### Starknet | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | [Opus](https://lindylabs.net/opus) | Dec 2023 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-12-opus-contracts-securityreview.pdf) | | [Aura](https://lindylabs.net) | Aug 2023 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-08-aura-securityreview.pdf) | | [Nostra](https://docs.tempus.finance/products/nostra) | Dec 2022 | 8 | | | | [StarkGate](https://starkgate.starknet.io/) | Dec 2022 | 2 | | | | [StarkEx](https://starkware.co/starkex/) | Oct 2022 | 1 | | | | [StarkNet token](https://starkware.co/starknet/) | Jul 2022 | 1 | | | | [StarkPerpetual](https://docs.starkware.co/starkex-v4/starkex-deep-dive/message-encodings/in-perpetual) | Jan 2022 | 8 | | | | [StarkEx](https://starkware.co/starkex/) | Nov 2021 | 8 | | | #### Solana | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | [Telcoin Solana Peg Stability Vault](https://bank.telco.in/) | May 2026 | 1.2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-06-telcoin-solanapegstabilityvault-securityreview.pdf) | | [Jobcoin Clock-in Program](https://jobcoin.app/clock-in/) | Mar 2026 | 0.6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026.03-jobcoin-clockinprogram-securityreview.pdf) | | [Anza Token-2022 Confidential Transfer, Blockchain](https://www.anza.xyz/) | Jan 2026 | 3 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2026-01-anza-token-2022-confidential-transfer-blockchain-securityreview.pdf) | | [Franklin Templeton Benji Contracts](https://www.franklintempleton.com/about-us/our-teams/specialist-investment-managers/digital-assets/digital-assets-technology) | Feb 2025 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-02-franklintempleton-benjicontracts-securityreview.pdf) | | [ZetaChain Solana Gateway](https://www.zetachain.com/) | Jan 2025 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-01-zetachain-solana-gateway-security-review.pdf) | | [Solang Code Generation](https://solana.com/) | Nov 2023 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-11-solana-solang-code-generation-securityreview.pdf) | | [Solang Code Generation, Part 1](https://solana.com/) | Nov 2023 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-11-solana-solang-code-generation-part-1-securityreview.pdf) | | [Squads V4](https://squads.so/) | Oct 2023 | 2 | [Squads](https://x.com/SquadsProtocol/status/1725548225804005464?s=20) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-10-squadsv4-securityreview.pdf) | | [Solang Parser and Semantic Analysis](https://solana.com/) | Sep 2023 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-09-solana-solang-parser-semantic-analysis-securityreview.pdf) | | [Solang Solana Library](https://solana.com/) | Jul 2023 | 1 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2023-07-solana-solang-library-securityreview.pdf) | | [Token-2022 Program](https://spl.solana.com/token-2022) | Feb 2023 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-02-solana-token-2022-program-securityreview.pdf) | | [Drift Protocol](https://www.drift.trade/) | Dec 2022 | 6 | [Drift](https://twitter.com/driftprotocol/status/1635630624978640899?s=46&t=f8ijViICJAoKBBoQUh58Og) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2022-12-driftlabs-driftprotocol-securityreview.pdf) | | [Solana](https://solana.com/) | Apr 2022 | 12 | | | #### Substrate | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | [zkVerify](https://zkverify.io/) | Feb 2025 | 3 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2025-02-zkverify-foundation-blockchain-securityreview.pdf) | | [ParaSpace](https://para.space/) | Dec 2022 | 1 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/ParallelFinance3.pdf) | | [ParaSpace](https://para.space/) | Nov 2022 | 7 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/ParallelFinance2.pdf)[✅](https://github.com/trailofbits/publications/blob/master/reviews/ParallelFinance2FixReview.pdf) | | [Parallel Finance](https://parallel.fi/) | Mar 2022 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/ParallelFinance.pdf) | | [Polkadex](https://www.polkadex.trade/) | Feb 2022 | 10 | | | | [Polkadex](https://www.polkadex.trade/) | Dec 2021 | 4 | | | | [PINT](https://pub.finance/) | Sep 2021 | 4 | | | | [Polkaswap](https://soramitsu.co.jp/) | Aug 2021 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/2021-08-soramitsu-polkaswap-securityreview.pdf) | | [AlephBFT](https://alephzero.org/) | Jun 2021 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/AlephBFT.pdf) | | [Acala Network](https://acala.network/) | Jun 2021 | 4 | | | | [Compound Chain](https://compound.finance/) | May 2021 | 6 | | | | [Acala Network](https://acala.network/) | Jan 2021 | 6 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/AcalaNetwork.pdf) | | [Parity Fether](https://www.parity.io/) | Aug 2019 | 4 | | | | [Parity](https://www.parity.io/) | Jul 2018 | 12 | [Parity completes Trail of Bits security review](https://medium.com/paritytech/parity-completes-trail-of-bits-security-review-bda9d48fd3d4) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/parity.pdf) | #### Tendermint/Cosmos | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | [Orga and Merk](https://turbofish.org/) | Nov 2024 | 10 | [Orga & Merk Trail of Bits Security Audit](https://turbofish.org/blog/audit) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-11-orgaandmerk-securityreview.pdf) | | [Berachain polaris-geth](https://www.berachain.com/) | Aug 2023 | 8 | | | | [Berachain berachain](https://www.berachain.com/) | Jun 2023 | 6 | | | | [Umee](https://www.umee.cc/) | Feb 2022 | 8 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Umee.pdf) | | [Columbus-5](https://www.terra.money/) | Jan 2022 | 2 | | | | [IBC Protocol](https://www.interchain.berlin/) | Dec 2021 | 4 | | | | [THORChain](https://thorchain.org/) | Aug 2021 | 12 | | | | [Tendermint](https://interchain.io/) | Mar 2019 | 12 | | | | [ndau](https://oneiro.io/) | Nov 2018 | 8 | [Policy Council](https://www.globenewswire.com/news-release/2019/05/22/1840819/0/en/ndau-Holders-Elect-Inaugural-Policy-Council-Votes-to-be-Listed-on-BitMart-Exchange.html) | | #### Tezos | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | [Kolibri](https://tezos.foundation/) | Apr 2022 | 4 | | | | [Tezori (T2)](https://github.com/Cryptonomic/Tezori) | Dec 2020 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Tezori.pdf) | | [Dexter](https://dexter.exchange/) | Jun 2020 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/dexter.pdf) | | [Tezori](https://github.com/Cryptonomic/Tezori) | Jul 2018 | 2 | [Thanks to @trailofbits for their security review](https://twitter.com/CryptonomicTech/status/1015686612641042434) | #### TON | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | [TONCO CLAMM DEX v1.6](https://app.tonco.io/#/swap) | Jan 2026 | 11 | [TONCO v1.6 is live](https://x.com/Tonco_io/status/2020808567419195632) | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-02-tonco-clamm-securityreview.pdf) | | [EVAA Finance](https://evaa.finance/) | Aug 2025 | 8.6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-08-evaafinance-securityreview.pdf) | | [Swap Coffee TON DEX](https://swap.coffee/dex/) | Jul 2025 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-07-swapcoffee-tondex-securityreview.pdf) | | [FIVA Yield Protocol](https://www.thefiva.com/) | May 2025 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-05-FIVA-yieldtokenizationprotocol-securityreview.pdf) | | [FIVA Evaa Integration](https://www.thefiva.com/) | May 2025 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-05-FIVA-evaaintegration-securityreview.pdf) | | [Whales Holders](https://whalesdmcc.com/) | May 2025 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-05-whales-dmcc-holders-contracts-securityreview.pdf) | | [Whales Nominators](https://whalesdmcc.com/) | May 2025 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-05-whales-dmcc-nominators-contract-securityreview.pdf) | | [STON.fi DEX V2](https://ston.fi/) | Jan 2025 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-01-stonfi-ton-amm-dex-v2-securityreview.pdf) | | [Tact Compiler](https://github.com/tact-lang/tact) | Jan 2025 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-01-ton-studio-tact-compiler-securityreview.pdf) | | [TON Foundation Multisignature Wallet](https://ton.foundation/en/) | Mar 2024 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-03-tonfoundation-multisignaturewallet-securityreview.pdf) | #### Other/Multi-Chain | Product | Date | Level of
Effort | Announcement | Report | | ---| --: | :-: | --- | :-: | | Mina Decentralized Treasury | Jun 2026 | 4.6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-06-mina-decentralizedtreasury-securityreview.pdf) | | [EthStaker Deposit CLI](https://github.com/ethstaker/ethstaker-deposit-cli) | Mar 2026 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-03-ethstaker-deposit-cli-securityreview.pdf) | | [Chainlink LlamaRisk LlamaGuard NAV CRE](https://chain.link/) | Feb 2026 | 1 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2026-02-chainlink-llamariskllamaguardnavcre-securityreview.pdf) | | [Chainlink Custom Senders and Receivers](https://chain.link/) | Feb 2025 | 4 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-02-chainlink-customsendersreceivers-securityreview.pdf) | | [Shape Gasback](https://shape.network/) | Jan 2025 | 2 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2025-01-shape-gasback-securityreview.pdf) | | [PixelSwap DEX](https://www.pixelswap.io/) | Dec 2024 | 6 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-12-pixelswap-dex-securityreview.pdf) | | [Arkis Prime](https://www.arkis.xyz/) | Dec 2024 | 5 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-12-arkis-defi-prime-brokerage-securityreview.pdf) | | [Franklin Templeton Aptos](https://digitalassets.franklintempleton.com/benji/) | Oct 2024 | 3 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2024-10-franklintempleton-aptos-securityreview.pdf) | | [Wormhole Governors and Watchers](https://wormhole.com/) | Mar 2023 | 8 | | [📄✅](https://github.com/trailofbits/publications/blob/master/reviews/2023-03-wormhole-securityreview.pdf) | | [DFINITY Canister Sandbox](https://dfinity.org/) | Sep 2022 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/DFINITYCanisterSandbox.pdf)[✅](https://github.com/trailofbits/publications/blob/master/reviews/DFINITYCanisterSandboxFixReview.pdf) | | [DFINITY ECDSA/BTC](https://dfinity.org/) | Sep 2022 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/DFINITYThresholdECDSAandBtcCanisters.pdf)[✅](https://github.com/trailofbits/publications/blob/master/reviews/DFINITYThresholdECDSAandBtcCanistersFixReview.pdf) | | [FROST BLS Protocols](https://www.polysign.io/) | Jul 2022 | 12 | | | | [SORA Trustless Bridge](https://soramitsu.co.jp/) | Jul 2022 | 8 | | | | [CAT Standard](https://chia.net/) | Jun 2022 | 8 | | | | [DFINITY Threshold ECDSA](https://dfinity.org/) | May 2022 | 8 | | | | [Arbitrum Nitro](https://offchainlabs.com/) | Mar 2022 | 16 | | | | [DeGate](https://degate.com/?en-US) | Feb 2022 | 4 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/DeGate.pdf) | | [ShardX](https://www.gemini.com/) | Dec 2021 | 2 | | | | [DeGate](https://degate.com/?en-US) | Dec 2021 | 4 | | | | [Threshold-DSA](https://anyswap.exchange/) | Nov 2021 | 6 | | | | [DFINITY Consensus](https://dfinity.org/) | Nov 2021 | 2 | [DFINITY](https://forum.dfinity.org/t/internet-computer-consensus-security-assessment-by-trail-of-bits-third-party-security-audit-2/11453) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/DFINITYConsensus.pdf) | | [PolySign HSM](https://polysign.io/) | Oct 2021 | 6 | | | | [Hop Protocol V2](https://hop.exchange/) | Sep 2021 | 4 | | | | [Golden Gate Library](https://layerzero.network/) | Sep 2021 | 1 | | | | [PolySign](https://www.polysign.io/) | Sep 2021 | 6 | | | | [Qredo Blockchain](https://www.qredo.com/) | Sep 2021 | 6 | | | | [Arbitrum](https://offchainlabs.com/) | Sep 2021 | 16 | | | | [go-schnorrkel](https://chainsafe.io/) | Aug 2021 | 4 | | | | [ShardX](https://www.gemini.com/) | Aug 2021 | 4 | | | | [AElf](https://aelf.io/) | Jul 2021 | 4 | | | | [CrossChain-Bridge](https://anyswap.exchange/bridge) | Jul 2021 | 8 | | | [DFINITY](https://dfinity.org/) | May 2021 | 24 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/DFINITY.pdf) | | [Open Oracle](https://chain.link/) | Apr 2021 | 2 | | | | [Arbitrum V2](https://offchainlabs.com/) | Feb 2021 | 8 | | | | [eFIL](https://www.gemini.com/blog/gemini-launches-wrapped-filecoin-efil-building-a-bridge-to-defi) | Jan 2021 | 2 | | | | [Highway Consensus](https://casperlabs.io/en/) | Nov 2020 | 4 | [CasperLabs](https://blog.casperlabs.io/trail-of-bits-security-audit-casper-highway-protocol/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/CasperLabsHighwayProtocol.pdf) | | [Stacks V2](https://www.blockstack.org/) | Sep 2020 | 6 | | | | [VRFs](https://chain.link/) | Aug 2020 | 2 | | | | [Celo Oracle](https://github.com/trailofbits/publications/blob/master/clabs.co) | Jul 2020 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/celo-oracle.pdf) | | [Arbitrum](https://offchainlabs.com/) | Jul 2020 | 6 | | | | [MYKEY](https://mykey.org/en) | Jul 2020 | 4 | | | | [Symbol](https://symbolplatform.com/) | Jul 2020 | 4 | [Symbol](https://symbolplatform.com/latest/symbol-from-nem-completes-trail-of-bits-security-audit/) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/Symbol.pdf) | | [Ledger Filecoin](https://protocol.ai/) | Jul 2020 | 2 | | [📄](https://github.com/trailofbits/publications/blob/master/reviews/LedgerFilecoin.pdf) | | [Chainlink](https://chain.link/) | Jun 2020 | 8 | | | | [Chainlink Flux](https://chain.link/) | May 2020 | 4 | | | | [Elrond](https://elrond.com/) | Mar 2020 | 6 | | | | [EOSIO SDK](http://block.one/) | Jan 2020 | 4 | | | | [NEAR Protocol](https://nearprotocol.com/) | Nov 2019 | 8 | | | | [EOSIO 2.0](http://block.one/) | Oct 2019 | 8 | | | | [Status-go](https://status.im/) | Oct 2019 | 9 | | | | [Celo](https://celo.org/) | Sep 2019 | 8 | | | | [Blockchain.com](https://www.blockchain.com/) | Aug 2019 | 4 | | | | [RandomX](https://www.arweave.org/) | Jun 2019 | 2 | [Monero and Arweave to Validate RandomX](https://www.prnewswire.com/news-releases/monero-and-arweave-to-validate-the-proof-of-work-algorithm-randomx-300861697.html) | [📄](https://github.com/trailofbits/publications/blob/master/reviews/arweave-randomx.pdf) | | Interest Token | May 2019 | 0.28 | | | | [Loom](https://loomx.io/) | May 2019 | 10 | [Loom SDK Q1 2019 Security Audit](https://twitter.com/loomnetwork/status/1126748703530766336) | | | [Building Blocks](https://innovation.wfp.org/project/building-blocks) | Aug 2018 | 7 | [UN WFP uses Ethereum to aid 100k refugees](https://www.parity.io/un-world-food-programme-uses-parity-ethereum-to-aid-100-000-refugees/) | | ## Disclosures and exploits Check the [exploits repository](https://github.com/trailofbits/exploits) too. |Name|Product|Discoverer|Year|ID|Blog| |---|---|---|---|---|---| |Denial of Service in protobuf-python|protobuf-python|Alexis Challande|2025|[CVE-2025-4565](https://github.com/advisories/GHSA-8qvm-5x2c-j2w7)|| |Vulnerabilities in LUKS2 disk encryption for confidential VMs|Linux LUKS2|Tjaden Hess|2025|[CVE-2025-59054](https://nvd.nist.gov/vuln/detail/CVE-2025-59054), [CVE-2025-58356](https://nvd.nist.gov/vuln/detail/CVE-2025-58356)|[💬](https://blog.trailofbits.com/2025/10/30/vulnerabilities-in-luks2-disk-encryption-for-confidential-vms/)| |Prompt injection to RCE in AI agents|AI Agents (multiple platforms)|Will Vandevanter|2025|❌|[💬](https://blog.trailofbits.com/2025/10/22/prompt-injection-to-rce-in-ai-agents/)| |Code integrity bypass in Electron applications|Electron Applications (Signal, 1Password, Slack)|Darius Houle|2025|[CVE-2025-55305](https://nvd.nist.gov/vuln/detail/CVE-2025-55305)|[💬](https://blog.trailofbits.com/2025/09/03/subverting-code-integrity-checks-to-locally-backdoor-signal-1password-slack-and-more/)| |Weaponizing image scaling against production AI systems|Google Gemini, Vertex AI, Genspark|Kikimora Morozova, Suha Sabi Hussain|2025|❌|[💬](https://blog.trailofbits.com/2025/08/21/weaponizing-image-scaling-against-production-ai-systems/)| --- [Read more](https://github.com/trailofbits/publications)

Most Popular

publications

Publications from Trail of Bits

Academic Papers