Trail of Bits 的出版物
学术论文
白皮书
指南与手册
会议演讲
自动化漏洞发现与利用
| 演讲标题 | 作者 | 年份 |
|---|
| 在 Go 中发现隐藏溢出：超越编译器极限的模糊测试 | Kevin Valerio | 2026 |
| Buttercup：自主规模化发现并修复开源软件中的缺陷 | Ronald Eytchison | 2025 |
| Buttercup：Trail of Bits 对 DARPA AI 网络挑战赛解决方案的未来 | Trent Brunson | 2025 |
| Buttercup 与 DARPA AI 网络挑战赛，Ringzer0 | Henrik Brodin, Ronald Eytchison | 2025 |
| 我们参加 AI 网络挑战赛的经验 | Michael Brown et al. | 2025 |
| Buttercup 与 DARPA AI 网络挑战赛，CSAW | Ronald Eytchison | 2024 |
| 你的缓解措施就是我的机会 | Yarden Shafir | 2023 |
| 通过混合控制流与数据流检测变异性缺陷 | Kelly Kaoudis, Henrik Brodin, Evan Sultanik | 2023 |
| 盲点：识别可利用的程序输入 | Henrik Brodin, Evan Sultanik, and Marek Surovič | 2023 |
| MLIR 是程序分析的未来 | Peter Goodman | 2023 |
| 关于计算牺牲之赦免的布道；或者说，编写一款荒谬 NES 游戏的超量祝福 | Evan Sultanik | 2021 |
| x86-64 指令解码器的差异分析 | William Woodruff, Niki Carroll, Sebastiaan Peters | 2021 |
| 当（基本）事实并非真实时如何发现缺陷 | William Woodruff | 2020 |
| 通过解析器实现的语义标注实现自动化文法提取 | Carson Harmon, Brad Larsen, Evan Sultanik | 2020 |
| 文件的背叛与驯服它的两个新工具 | Evan Sultanik | 2019 |
| 对模糊暴君进行符号执行 | Stefan Edwards | 2019 |
| 使用 KRF 进行内核空间故障注入 | William Woodruff | 2019 |
| 使用 KLEE-Native 进行二进制符号执行 | Sai Vegasena | 2019 |
| 对 Linux 内核开启疯狂模式 | William Woodruff | 2019 |
| 使用 Binary Ninja 进行漏洞建模 | Josh Watson | 2018 |
| 文件多语艺术；或者说，这个 PoC 也是一张猫的图片 | Evan Sultanik | 2017 |
| 成为二进制摇滚明星 | Sophia D'Antoine | 2017 |
| 面向人类的符号执行 | Mark Mossberg | 2017 |
| 90 年代的精神在布鲁克林依然存在 | Ryan Stortz, Sophia D'Antoine | 2017 |
| 静态与动态分析对决的梦想 | Ryan Stortz | 2016 |
| 用于自动利用生成的二进制约束求解 | Sophia D'Antoine | 2016 |
| 智能模糊测试革命 | Dan Guido | 2016 |
| 构建可扩展的自动化黑客系统 | Artem Dinaburg | 2016 |
| Cyberdyne - 规模化自动漏洞发现 | Peter Goodman | 2016 |
| McSema：将 x86 静态转换为 LLVM IR | Andrew Ruef, Artem Dinaburg | 2014 |
区块链| 演示标题 | 作者 | 年份 |
| --- | --- | --- |
| 使用 Slither 进行变异测试：发现高危问题的新方法 | Guillermo Larregay | 2025 |
| Slither 的模型上下文协议：通过静态分析为 LLM 提供真实依据 | Ben Samuels | 2025 |
| 15 亿美元的问题：交易所如何构建更安全的冷存储 | Benjamin Samuels | 2025 |
| 如何成为智能合约审计员 | nisedo | 2025 |
| 测试你的测试：测试的注意事项 | Kurt Willis | 2023 |
| Slither：用于 Vyper 和 Solidity 的静态分析工具 | Troy Sargent | 2023 |
| Roundme：让舍入分析变得更简单 | Josselin Feist | 2023 |
| 智能合约：Beta 版 | Nat Chin | 2023 |
| 像安全工程师一样进行模糊测试 | Nat Chin | 2023 |
| 使用 Slither 的 Python API 编写更好的智能合约 | Troy Sargent | 2022 |
| 构建安全的 Cairo | Filipe Casal, Simone Monica | 2022 |
| 如何像专家一样进行模糊测试 | Josselin Feist, Nat Chin | 2022 |
| 揭开模糊测试的神秘面纱 | Nat Chin | 2022 |
| 为智能合约构建实用的静态分析器 | Josselin Feist | 2021 |
| 测试与验证智能合约：从理论到实践 | Josselin Feist | 2021 |
| 安全集成 ERC20 代币 | Josselin Feist | 2021 |
| 使用 Manticore 检测交易替换攻击 | Sam Moelius | 2020 |
| DeFi 攻击与未来威胁：经济学在安全协议设计中的作用 | Dan Guido | 2020 |
| 奇妙的 Bug 以及如何消灭它们；或 Solidity 的罪状 | Evan Sultanik | 2019 |
| SlithIR：使用 Solidity 的 IR 进行高精度安全分析 | Josselin Feist | 2019 |
| Slither：智能合约静态分析框架 | Josselin Feist | 2019 |
| 区块链做对了什么 | Dan Guido | 2019 |
| 面向区块链公司的传统信息安全 | Dan Guido | 2019 |
| 智能合约的属性测试 | JP Smith | 2018 |
| 不安全编程语言的解剖 | Evan Sultanik | 2018 |
| 合约升级风险与建议 | Josselin Feist | 2018 |
| Blackhat Ethereum | Ryan Stortz, Jay Little | 2018 |
| 区块链尸检——分析智能合约的消亡 | Jay Little | 2018 |
| Rattle——一个以太坊 EVM 二进制分析框架 | Ryan Stortz | 2018 |
| 保护以太坊区块链上的价值 | Dan Guido | 2018 |
| 二进制分析，遇见区块链 | Mark Mossberg | 2018 |
| 区块链自动漏洞查找 | Felipe Manzano, Josselin Feist | 2017 |
编译器
密码学
工程
教育
基础设施
机器学习
移动安全
编程
侧信道
供应链
威胁分析与恶意软件
播客| 播客 | 嘉宾 | 日期 | 主题 |
| --- | --- | --- | --- |
| Risky Biz | Dan Guido | Feb 2026 | Trail of Bits 的 AI |
| What's in the SOSS? 53 | Michael Brown | Feb 2026 | AIxCC 与 Buttercup |
| Insecure Agents 18 | Kikimora Morozova | Dec 2025 | AI 提示注入 |
| Risky Biz | Keith Hoodlet | Sep 2025 | AI 提示注入 |
| Zero Signal | Keith Hoodlet | Sep 2025 | AI 安全 |
| Unsupervised Learning | Michael Brown | Aug 2025 | AIxCC |
| Security Weekly 342 | Will Vandevanter | Aug 2025 | NVIDIA 漏洞披露 |
| CTF Radiooo 01E | Michael Brown & Evan Downing | Aug 2025 | AIxCC |
| Click Here Show | Dan Guido | Jun 2025 | Zoom 远程控制攻击 |
| Security Weekly 336 | Artur Cygan | Jun 2025 | 条形码模糊测试 |
| Protect AI | Keith Hoodlet | Jun 2025 | MCP 安全 |
| Open Source Security | William Woodruff | May 2025 | Zizmor 与 GitHub Actions 安全 |
| MLSecOps | Keith Hoodlet | Apr 2025 | AI/ML 安全 |
| Risky Biz 786 | Tjaden Hess | Apr 2025 | 密码学与区块链 |
| Security Weekly 323 | Keith Hoodlet | Mar 2025 | 应用安全中的 GenAI |
| Xyonix | Keith Hoodlet | Mar 2025 | AI/ML 安全 |
| The Impulsive Thinker | Dan Guido | Feb 2025 | 神经多样性 |
| Bugcrowd | Keith Hoodlet | Oct 2024 | AI/ML 偏见 |
| Risky Biz | Dan Guido | Oct 2024 | 后量子密码学 |
| Risky Biz 759 | Dan Guido | Aug 2024 | DARPA 的 AI 网络挑战赛 |
| Resilience Rundown | Josiah Dykstra | May 2024 | 安全中的偏见 |
| Risky Biz | Dan Guido | Apr 2024 | 开源工具 |
| MLSecOps March 20 | William Woodruff | Mar 2024 | 供应链安全 |
| yWhales | Dan Guido | Dec 2023 | 区块链安全 |
| Risky Biz 707 | Dan Guido | May 2023 | ML 安全 |
| ASW 229 | Nick Selby | Feb 2023 | 威胁建模、云原生审计 |
| Risky Biz 690 | Dan Guido | Jan 2023 | 漏洞披露 |
| Risky Biz 672 | Dan Guido | Jul 2022 | 区块链安全 |
| Cloud Security Reinvented | Nick Selby | Jun 2022 | 云安全 |
| Skiff Office Hours | Dan Guido | Mar 2022 | 隐私技术 |
| Risky Biz 652 | Dan Guido | Jan 2022 | 零知识证明 |
| Secureum Safecast #3 | Josselin Feist | Nov 2021 | 区块链安全 |
| Secureum Safecast #2 | Dan Guido | Oct 2021 | 区块链安全 |
| Press Freedom Foundation | Dan Guido | Jul 2021 | 移动安全与 iVerify |
| Employee Cycle | Hannah Hanks | Mar 2021 | 首位 PeopleOps 员工 |
| Risky Biz 614 | Dan Guido | Feb 2021 | iVerify |
| Building Better Systems 6 | Dan Guido | Jan 2021 | 区块链做对了什么 |
| WCBS 880 | Dan Guido | Sep 2020 | 间隔年与实习生招聘 |
| Risky Biz 594 | Dan Guido | Aug 2020 | Apple 安全 |
| Epicenter 346 | Dan Guido | Jun 2020 | 智能合约安全 |
| Absolute AppSec 97 | Stefan Edwards | May 2020 | 威胁建模 |
| Unchained 170 | Dan Guido | May 2020 | DeFi 安全 |
| Risky Biz 580 | Dan Guido | Apr 2020 | 移动投票 |
| Absolute AppSec 91 | Stefan Edwards | Apr 2020 | 移动投票 |
| Zero Knowledge 122 | Ben Perez | Mar 2020 | 密码学审查、ZKP |
| Changelog | Dan Guido | Jan 2020 | AlgoVPN |
| Risky Business 559 | Stefan Edwards | Oct 2019 | Kubernetes |
| FOSS Weekly 545 | William Woodruff | Sep 2019 | PyPI 安全改进 |
| Podcast.__init__ 225 | William Woodruff | Aug 2019 | PyPI 安全、用户体验与可持续性 |
| Absolute AppSec 68 | Stefan Edwards, Bobby Tonic | Aug 2019 | Kubernetes |
| Hashing it Out 53 | Dan Guido | Jul 2019 | 智能合约测试 |
| Absolute AppSec 60 | Stefan Edwards | May 2019 | Android、编程语言 |
| Absolute AppSec 55 | Stefan Edwards | Apr 2019 | 安全测试 |
| Hashing it Out 35 | Dan Guido, Josselin Feist | Jan 2019 | 以太坊失败的 EIP-1283 |
| Risky Biz 526 | JP Smith | Jan 2019 | CTF 中的后量子密码学 |
| Absolute AppSec 37 | Stefan Edwards | Nov 2018 | 编程语言、 symbex |
| Risky Biz 510 | Lauren Pearl | Aug 2018 | 开源安全工程 |
| Absolute AppSec 34 | Stefan Edwards | Oct 2018 | 安全测试、区块链 |
| The Smartest Contract 15 | JP Smith | Aug 2018 | Trail of Bits 安全工具与审计 |
| Zero Knowledge 16 | JP Smith | Mar 2018 | 智能合约安全 |
| Risky Biz 488 | JP Smith | Feb 2018 | 使用 Manticore 进行智能合约测试 |
| Risky Biz 474 | Dan Guido | Oct 2017 | 如何构建安全的软件 |
| Georgian Partners 47 | Dan Guido | May 2017 | AlgoVPN 与 Tor |
| VUC 643 | Dan Guido | Apr 2017 | AlgoVPN |
| Risky Biz 449 | Dan Guido | Mar 2017 | 控制流完整性 |
| Risky Biz 425 | Dan Guido | Sep 2016 | 回顾本周新闻 |
| Risky Biz 421 | Dan Guido | Aug 2016 | 汽车黑客与本周新闻 |
| Risky Biz 416 | Dan Guido | Jul 2016 | DARPA 网络大挑战赛 |
| Risky Biz 399 | Dan Guido | Feb 2016 | 苹果与 FBI 之争 |
| Risky Biz 348 | Dan Guido | Jun 2015 | DARPA 网络大挑战赛 |
| Risky Biz 370 | Dan Guido | Feb 2015 | DARPA 网络大挑战赛 |
网络研讨会
公开评论
案例研究
深度剖析客户如何与 Trail of Bits 合作：所面临的挑战、我们的方法以及最终成果。工作量以工程师周为单位。
| 客户 | 侧重点 | 日期 | 投入
工作量 | 案例研究 |
|---|
| Turnkey | TEE 与 AWS Nitro Enclaves 基础设施 | Jun 2026 | 8 | 📖 |
| Vanta | 多租户隔离架构审查 | Nov – Dec 2025 | 6 | 📖 |
| Scopely | Monopoly GO! PRNG 公平性设计评估 | Dec 2024 | 2 | 📖 |
| Hugging Face | Gradio 5.0 预发布安全评估 | Jun – Jul 2024 | 4 | 📖 |
| Scroll | zkEVM 电路安全审查 | Apr – Sep 2023 | 45.8 | 📖 |
安全审查
此处列出的是允许我们公开谈论工作内容的公司。还有更多项目仍处于保密状态。
主要客户
以下客户已委托 Trail of Bits 进行 5 次或更多次安全审查：
Frax Finance
MobileCoin
Offchain Labs| 产品 | 日期 | 投入
级别 | 公告 | 报告 |
| --- | --: | :-: | --- | :-: |
| Offchain Labs Arbitrum ArbOS 60/61 | Jul 2026 | 24 | | 📄 |
| Offchain Labs Reward Distributor Fixes | Jun 2026 | 0.8 | | 📄 |
| Offchain Labs Stylus SDK | Apr 2026 | 9 | | 📄 |
| Offchain Labs Arbitrum Quorum Changes | Feb 2026 | 1.2 | | 📄 |
| Offchain Labs Arbitrum Nitro External DA | Jan 2026 | 4 | | 📄✅ |
| Offchain Labs Arbitrum ArbOS 50 and 51 (Fusaka) | Dec 2025 | | | 📄 |
| Offchain Labs Arbitrum Chains Genesis File Generator | Dec 2025 | 1.6 | | 📄✅ |
| Offchain Labs Upgrade Executor | Jul 2025 | 0.2 | | 📄 |
| Offchain SetCoreGovernorQuorumAction | Jun 2025 | 1.2 | | 📄 |
| Offchain Arbitrum Mint/Burn Precompile | Jun 2025 | 1.8 | | 📄✅ |
| Offchain Arbitrum Block Hash Pusher | Jun 2025 | 1.8 | | 📄 |
| Offchain ArbOS 40 Nitro | May 2025 | 6 | | 📄 |
| Offchain Reward Distributor Fixes | Apr 2025 | 0.8 | | 📄 |
| Offchain Sequencer Liveness | Mar 2025 | 3 | | 📄 |
| Offchain Custom Fee Bridge & EIP-7702 | Mar 2025 | 1 | | 📄 |
| Offchain Geth 14.4 Pectra | Mar 2025 | 0.8 | | 📄 |
| Offchain Custom Fee Exchange Rate | Mar 2025 | 1 | | 📄 |
| Offchain Security Council Rotation | Mar 2025 | 1.6 | | 📄 |
| Offchain DisableGateway USDT | Mar 2025 | 0.4 | | 📄 |
| Offchain BoLD Fixes | Dec 2024 | 0.8 | | 📄 |
| Offchain Stylus Emergency Fixes | Oct 2024 | 2 | | 📄 |
| Offchain BoLD History Commits | Oct 2024 | 2 | | 📄 |
| Offchain Nitro with BoLD | Oct 2024 | 2.6 | | 📄 |
| Offchain Stylus | Sep 2024 | 2 | | 📄✅ |
| Offchain RARI | Aug 2024 | 0.6 | | 📄 |
| Offchain Office Hours Action | Aug 2024 | 0.6 | | 📄 |
| Offchain Timeboost Auction | Aug 2024 | 3 | | 📄 |
| Offchain Orbit Actions | Aug 2024 | 1 | | 📄 |
| Offchain USDC Gateway | Jul 2024 | 2 | | 📄 |
| Offchain BoLD & DAC Rewards | Jun 2024 | 3 | | 📄 |
| Offchain Arbitrum Stylus | May 2024 | 47 | | 📄 |
| Offchain L1-L3 Teleporter | Apr 2024 | 2 | | 📄 |
| Offchain ArbOS 31 | Apr 2024 | 2 | | 📄 |
| Offchain ArbOS 30 Nitro | Apr 2024 | 6 | | 📄 |
| Offchain BoLD | Apr 2024 | 5 | | 📄 |
| Offchain ArbOS | Feb 2024 | 4 | | 📄 |
| Offchain Arbitrum | Jan 2024 | 2 | | 📄 |
| Offchain Token Bridge Creator | Dec 2023 | 6 | | 📄 |
| Offchain Custom Fee Token | Sep 2023 | 3 | | 📄 |
| Offchain Arbitrum Challenge v2 | Aug 2023 | 20 | | 📄✅ |
Reserve Protocol
Uniswap
Western Digital
AI/ML 审查
密码学审查| 产品 | 日期 | 投入
水平 | 公告 | 报告 |
| ---| --: | :-: | --- | :-: |
| MAGIC Grants Monero FCMP ++ Crypto | Jul 2026 | 2 | | 📄✅ |
| Ripple Labs XRP Ledger Confidential Transfer | Apr 2026 | 6 | | 📄✅ |
| HyperLink AWS Nitro TEE | Mar 2026 | 2.2 | | 📄✅ |
| Open Home Foundation SecureTar v3 | Mar 2026 | 1 | | 📄✅ |
| Obsidian Sync | Dec 2025 | 2 | | 📄✅ |
| NEAR One PedPop+ | May 2025 | 4 | | 📄 |
| NEAR One MPC Chain Signatures | Mar 2025 | 6 | | 📄 |
| NEAR One Robust ECDSA | Feb 2026 | 6.4 | | 📄✅ |
| Anza BLS Signatures | Mar 2026 | 1 | | 📄 |
| DV Labs Charon Pedersen DKG | Feb 2026 | 2 | | 📄✅ |
| Anza Token-2022 Confidential Transfer, Cryptography | Jan 2026 | 7 | | 📄 |
| Calyx Institute HSM Provisioning Ceremony Scripts | Jan 2026 | 1 | | 📄✅ |
| BSV Blockchain TS-SDK | Jan 2026 | 6 | | 📄✅ |
| Bron Labs MCP Library | Jan 2026 | 8 | | 📄✅ |
| NEAR One Confidential Key Derivation | Dec 2025 | 4 | | 📄✅ |
| Zama | Oct 2025 | 32.2 | | |
| DFINITY Orbit | Sep 2025 | 4 | | 📄✅ |
| DFINITY Oisy | Sep 2025 | 4 | | 📄✅ |
| Google Longfellow | Aug 2025 | 4.6 | | 📄✅ |
| Open Quantum Safe liboqs | Apr 2025 | 5 | Open Quantum Safe | 📄 |
| Go Crypto Libraries | Mar 2025 | 12 | Go | 📄✅ |
| Zkonduit EZKL | Mar 2025 | 11 | EZKL | 📄✅ |
| Scopely Monopoly Go! | Dec 2024 | 2 | | 🔖 |
| Aligned | Dec 2024 | 3 | | 📄✅ |
| Discord DAVE | Sep 2024 | 5 | Discord | 📄✅ |
| Discord DAVE | Aug 2024 | 4 | Discord | 📄✅ |
| Lit Protocol Cait-Sith | Jun 2024 | 10 | | 📄✅ |
| Iron Fish FishHash | Apr 2024 | 1 | Iron Fish | 📄✅ |
| AgileBits Snow | Mar 2024 | 4 | | 📄✅ |
| Silence Laboratories Silent Shard | Feb 2024 | 5 | | 📄✅ |
| Snow | Jan 2024 | 4 | | 📄✅ |
| Ockam | Nov 2023 | 11 | Trail of Bits | 📄 |
| Dfinity Candid | Nov 2023 | 3 | | 📄✅ |
| Axiom Halo2 Library Upgrades | Oct 2023 | 6 | Axiom | 📄✅ |
| Aleo snarkVM, snarkOS, BullsharkBFT | Oct 2023 | 18 | Aleo | 📄✅ |
| Axiom Halo2 Libraries | Jun 2023 | 14 | Axiom | 📄✅ |
| Dfinity ckBTC and BTC Integration | Jun 2023 | 2.5 | 论坛, 博客 | |
| Dfinity SNS Phase 2 | Jun 2023 | 2.5 | 论坛, 博客 | 📄 |
| Thesis tss-lib BitForge | Jun 2023 | 0.2 | Threshold | 📄✅ |
| Chainflip | Apr 2023 | 12 | Chainflip | 📄✅ |
| Stealth Addresses | Feb 2023 | 2 | | 📄✅ |
| Succinct ZK Light Client | Feb 2023 | 8 | Succinct | 📄✅ |
| noble-curves Library | Jan 2023 | 2 | | 📄✅ |
| ParaSpace | Dec 2022 | 1 | | 📄 |
| Phantom Wallet | Nov 2022 | 2 | | |
| ParaSpace | Nov 2022 | 7 | | 📄✅ |
| SimpleX Chat | Oct 2022 | 1 | SimpleX | 📄 |
| Dfinity | Sep 2022 | 4 | 论坛, 博客 | 📄✅ |
| Aleo snarkVM | Sep 2022 | 12 | | 📄✅ |
| Microsoft/Verasion Go-COSE | Jul 2022 | 4 | | 📄✅ |
| BLS Signature Scheme | Jul 2022 | 1 | | |
| Binance CGGMP21 and FROST | May 2022 | 8 | | |
| Aleo snarkVM & snarkOS | Apr 2022 | 12 | | |
| Phantom Wallet | Apr 2022 | 4 | | |
| Parallel Finance | Mar 2022 | 6 | | 📄 |
| Polkadex | Feb 2022 | 10 | | |
| Linux Kernel | Apr 2021 | 2 | 发布签名与管理 | 📄 |
| Standard Notes | Mar 2020 | 1 | Standard Notes | 📄 |
| Project Callisto | Aug 2018 | 5 | | |
技术产品审查| 产品 | 日期 | 工作量
级别 | 公告 | 报告 |
| --- | --: | :-: | --- | :-: |
| PyTorch ExecuTorch | 2026年6月 | 9 | OSTIF| 📄✅ |
| Turnkey Key Management System | 2026年6月 | 8 | | 📄✅ |
| Persona Identities Claims Verification | 2026年5月 | 3 | | 🔖 |
| PyPI Warehouse | 2026年4月 | 6 | | 📄 |
| Propeller Heads Turbine Front End and SDK | 2026年3月 | 2 | | 📄✅ |
| Propeller Heads Turbine | 2026年3月 | 8 | | 📄✅ |
| Zoo Text-to-CAD Platform | 2026年3月 | 4 | | 📄✅ |
| iVerify | 2026年6月 | 2 | | 📄✅ |
| X XChat | 2025年10月 | 4 | | 📄✅ |
| Edera Runtime Container | 2025年10月 | 4 | | 📄 |
| Meta WhatsApp Private Processing | 2025年8月 | 12 | WhatsApp, Trail of Bits | 📄✅ |
| Discord E2EE WebAssembly | 2025年6月 | 3 | | 📄 |
| libVLC | 2025年5月 | 5 | | 📄 |
| NATS Server | 2025年2月 | 6 | | 📄✅ |
| Istio Ztunnel | 2024年12月 | 2 | OSTIF, Istio | 📄✅ |
| RubyGems.org | 2024年12月 | 5 | | 📄 |
| Kraken Wallet In-App Browser | 2024年11月 | 4 | | 📄✅ |
| Kraken Wallet iCloud Backup | 2024年9月 | 2 | | 📄✅ |
| Hugging Face Gradio | 2024年7月 | 4 | Hugging Face, Trail of Bits | 📄✅ |
| Zoo KittyCAD | 2024年6月 | 4.6 | | 📄✅ |
| Polygon Labs Iden3 Circuits | 2024年5月 | 2 | | 📄✅ |
| Kraken Mobile Wallet | 2024年1月 | 7 | Kraken| 📄✅ |
| Eclipse Temurin | 2023年12月 | 4 | 回应, OSTIF, Eclipse Foundation | 📄✅ |
| Arch Linux Pacman | 2023年12月 | 2 | OTF | 📄✅ |
| cURL HTTP3 | 2023年12月 | 4 | OSTIF, Daniel Stenberg | 📄 |
| Lisk SDK 6.1 modules | 2023年9月 | 4 | | 📄✅ |
| OpenSSL | 2023年9月 | 9 | OSTIF, OpenSSL | 📄✅ |
| PyPI Warehouse | 2023年9月 | 10 | PyPI, Trail of Bits | 📄✅ |
| wasmCloud | 2023年9月 | 6 | | 📄✅ |
| Worldcoin | 2023年8月 | 6 | | 📄✅ |
| Homebrew | 2023年8月 | 6 | | 📄 |
| DigitalOcean OIDC | 2023年8月 | 4 | | 📄 |
| Flux | 2023年8月 | 4 | OSTIF, Flux | 📄✅ |
| Lisk SDK | 2023年7月 | 30 | | 📄✅ |
| DragonFly2 | 2023年7月 | 4 | Dragonfly, OSTIF | 📄✅ |
| Eclipse JKube | 2023年5月 | 5 | OSTIF, Eclipse | 📄✅ |
| Chainflip | 2023年4月 | 12 | Chainflip | 📄✅ |
| Eclipse Mosquitto | 2023年3月 | 4 | OSTIF, Eclipse | 📛📄✅ |
| Eclipse Jetty | 2023年3月 | 6 | Jetty, Eclipse | 📄✅ |
| Spool Platform | 2023年3月 | 8 | | 📄✅ |
| Redpanda Platform | 2023年1月 | 4 | | |
| Injective Labs Options Market | 2023年1月 | 4 | | |
| OpenVPN3 | 2023年1月 | 6 | | |
| OpenVPN2 | 2022年12月 | 4 | OpenVPN | 📄✅ |
| OpenArchive Save (Android) | 2022年12月 | 1 |OpenArchive Save | 📄✅ |
| Enclave Markets | 2022年11月 | 9 | | |
| Fiat Ramps | 2022年11月 | 4 | | |
| cURL | 2022年10月 | 9.5 | OSTIF, Daniel Stenberg. Trail of Bits | 📄✅📛 |
| CloudEvents | 2022年10月 | 4 | OSTIF | 📄 |
| OpenArchive Save (iOS) | 2022年10月 | 1.2 |OpenArchive Save | 📄✅ |
| AlphaSOC API | 2022年9月 | 1 | | 📄✅ |
| Consul Enterprise | 2022年9月 | 6 | | |
| snarkVM | 2022年9月 | 12 | | 📄✅ |
| Hashicorp Boundary | 2022年7月 | 6 | | |
| Skiff | 2022年7月 | 6 | |
| Terraform Cloud | 2022年6月 | 6 | |
| Datadog | 2022年5月 | 6 | |
| MATTR | 2022年5月 | 4 | |
| ArmorLock | 2022年4月 | 6 | |
| DigitalOcean Function | 2022年4月 | 4 | |
| Auvik Collector | 2022年4月 | 8 | |
| Fuchsia Platform | 2022年3月 | 8 | |
| Optimus ROM | 2022年1月 | 4 | | |
| BitcoinBeach | 2022年3月 | 4 | | 📄 |
| osquery | 2022年1月 | 6 | | 📄 |
| Redjack | 2021年12月 | 2 | |
| DigitalOcean Cloud | 2021年11月 | 12 | |
| SpruceID | 2021年10月 | 12 | | 📄 |
| Doppler | 2021年9月 | 4 | |
| Datadog Agent | 2021年8月 | 8 | |
| Appian | 2021年6月 | 4 | | |
| Cashero-2.0 | 2021年6月 | 4 | | |
| Orbit | 2021年4月 | 1 | | |
| VGS Proxy | 2021年4月 | 4 | | |
| Skiff | 2021年2月 | 4 | | |
| CircleCI Server 3.0 | 2021年1月 | 6 | CircleCI 的渗透测试 |
| BitMEX | 2021年1月 | 4 | | |
| SecureDrop | 2020年12月 | 8 | SecureDrop Workstation 的第二次审计 | 📄 |
| Citizen Browser | 2020年12月 | 0.43 | 我们如何构建 Facebook 检查器|
| Ren | 2020年8月 | 4 | 8 月开发更新 | 📄 |
| Hey.com | 2020年6月 | 1 | 严肃安全 | 📄 |
| Azure Sphere | 2020年6月 | 12 | Azure Sphere 20.07 安全增强 |
| Zoom | 2020年5月 | 9 | 90 天已完成，Zoom 下一步是什么 |
| Secure Transport | 2020年4月 | 4 | | |
| ZeroTier 2.0 | 2020年3月 | 2 | ZeroTier | 📄 |
| Voatz | 2020年2月 | 12 | Voatz, Tusk | 📄📛 |
| Vault | 2020年2月 | 12 | | |
| Voice | 2020年1月 | 4 | | |
| Azure Sphere | 2019年6月 | 12 | | |
| zlib | 2016年9月 | 1 | | 📄 |
云原生评审
不变量测试与开发项目
区块链评审
钱包评审
Algorand
Avalanche
比特币与衍生品| 产品 | 日期 | 工作量
级别 | 公告 | 报告 |
| ---| --: | :-: | --- | :-: |
| ZetaChain Bitcoin Inscriptions | Jan 2025 | 2 | | 📄✅ |
| Nomic | Nov 2024 | 10 | Nomic | 📄✅ |
| STAS SDK | Oct 2021 | 4 | | |
| STAS-JS SDK | Sep 2021 | 4 | | |
| Bitcoin SV | Jan 2021 | 6 | |
| Zcoin | Jul 2020 | 2 | Zcoin | 📄 |
| Zcash | Apr 2020 | 3 | Electric Coin Co. | 📄 |
| Zcash | Nov 2019 | 6 | NU3、Blossom 和 Sapling 安全审查| 📄 |
| Zcash | Nov 2019 | 6 | | 📄 |
| Paymail Protocol | Nov 2019 | 7 | | |
| Simple Ledger | Oct 2019 | 3 | | |
| Bitcoin SV | Nov 2018 | 12 | |
| RSKj | Nov 2017 | 6 | RSK 安全审计结果 | 📄 |
以太坊/EVM| 产品 | 日期 | 投入
水平 | 公告 | 报告 |
| ---| --: | :-: | --- | :-: |
| Arcus Labs Rootchain v5 Smart Contracts | Jun 2026 | 2 | | 📄✅ |
| Kiln Lagoon Vault Diff Review | May 2026 | 1 | | 📄✅ |
| Franklin Templeton BenjiSwap Differential Review | Apr 2026 | 1.2 | | 📄✅ |
| Gensyn Buyback-and-Burn Vault | Apr 2026 | 1 | | 📄✅ |
| Gensyn Bridged Token | Apr 2026 | 0.2 | | 📄 |
| Gensyn ERC-20 Token | Sep 2025 | 0.2 | | 📄 |
| Gensyn Delphi Dynamic Paramutuel Markets | Apr 2026 | 3.4 | | 📄✅ |
| Shape TokenLock | Mar 2026 | 0.4 | | 📄✅ |
| Aave v4 | Feb 2026 | 6 | | 📄✅ |
| VeChain VeChainThor Hayabusa Upgrade | Oct 2025 | 6 | | 📄✅ |
| Franklin Templeton BenjiSwap Contract | Oct 2025 | 1 | | 📄✅ |
| Radius Technology EVMAuth | Oct 2025 | 1.2 | | 📄✅ |
| Shape Buyback Contract | Sep 2025 | 0.4 | | 📄✅ |
| Starkware StarkEx Diff | Aug 2025 | 0.2 | | 📄 |
| Shape Token Contract | May 2025 | 1 | | 📄✅ |
| CAP Labs Covered Agent Protocol | May 2025 | 9 | | 📄✅ |
| Fabric Labs Zipper Protocol | May 2025 | 1 | | 📄✅ |
| Lagrange LAToken | Apr 2025 | 3 | | 📄 |
| Serai DEX | Apr 2025 | 3 | | 📄✅ |
| Automata | Feb 2025 | 8 | | 📄✅ |
| Bunni v2 | Jan 2025 | 8 | | 📄✅ |
| Everstake Staking | Jan 2025 | 3 | | 📄✅ |
| Parabol Smart Contracts Updates | Jan 2025 | 0.4 | | 📄 |
| BeethovenX Sonic Staking | Jan 2025 | 1 | | 📄✅ |
| Balancer v3 | Dec 2024 | 6 | | 📄✅ |
| ULTI | Dec 2024 | 1 | | 📄✅ |
| EthStaker Deposit CLI | Dec 2024 | 4 | | 📄✅ |
| Plume | Nov 2024 | 1 | | 📄✅ |
| Treehouse tETH Protocol | Sep 2024 | 4 | | 📄✅ |
| Elixir Protocol | Aug 2024 | 4 | | 📄✅ |
| Onchain Pass | Aug 2024 | 1 | | 📄✅ |
| Taraxa Ficus Bridge | Jul 2024 | 1.6 | | 📄✅ |
| Devcon Auction Raffle | Jun 2024 | 1 | | 📄✅ |
| Aladdin f(x) Oracle | Jun 2024 | 2 | | 📄✅ |
| AiLayer 6079 Contracts | May 2024 | 3 | | 📄✅ |
| Hydrogen Rover Protocol | May 2024 | 0.45 | | 📄 |
| Lisk Smart Contracts | May 2024 | 4 | | 📄✅ |
| Parabol Smart Contracts | May 2024 | 2 | | 📄✅ |
| Wonderland Prophet | May 2024 | 4 | | 📄✅ |
| SEDA Chain Token Migration | Mar 2024 | 1 | | 📄✅ |
| Lisk Smart Contracts | Mar 2024 | 4.6 | | 📄✅ |
| Bondex Smart Contracts | Mar 2024 | 0.6 | | 📄 |
| Aladdin f(x) Protocol | Mar 2024 | 4 | | 📄✅ |
| Puffer Finance Contracts | Mar 2024 | 1.2 | | 📄✅ |
| Intuition | Mar 2024 | 2 | | 📄 |
| Helios Global | Feb 2024 | 1 | | 📄✅ |
| ScopeLift Stealth Addresses | Feb 2024 | 1 | | 📄✅ |
| MetaLayer Blast | Jan 2024 | 4 | | 📄✅ |
| Unibot Router | Dec 2023 | 1.6 | | 📄✅ |
| Acronym Foundation | Dec 2023 | 4 | | 📄✅ |
| Pyth Entropy | Dec 2023 | 4 | | 📄 |
| Immutable Bridge | Nov 2023 | 2 | | 📄✅ |
| Salty.IO Protocol | Oct 2023 | 6 | | 📄✅ |
| Spiko Smart Contracts | Oct 2023 | 1 | | 📄✅ |
| Hyperlane v3 | Sep 2023 | 2 | | 📄✅ |
| Elixir Contracts | Sep 2023 | 2 | | 📄✅ |
| NZDD token | Aug 2023 | 0.6 | | 📄✅ |
| Immutable | Aug 2023 | 4 | | 📄✅ |
| Sandclock | Jul 2023 | 8 | | 📄✅ |
| Arcade | Jul 2023 | 8 | | 📄✅ |
| Nested Tetris/HyVM | Jun 2023 | 1 | | 📄✅ |
| Franklin Templeton | May 2023 | 4 | | 📄✅ |
| Prysm | Apr 2023 | 8 | | 📄✅ |
| Ajna Protocol | Apr 2023 | 12 | | 📄✅ |
| Raft | Apr 2023 | 2 | | 📄✅ |
| MYSO v2 | Apr 2023 | 2 | MYSO | 📄✅ |
| Smardex AMM | Apr 2023 | 2 | | 📄✅ |
| Waymont | Mar 2023 | 1 | | |
| Atlendis | Mar 2023 | 6 | Atlendis | 📄✅ |
| Primitive Hyper | Mar 2023 | 8 | | 📄✅ |
| Succinct Light Client | Feb 2023 | 8 | Succinct | 📄✅ |
| Nested Finance | Feb 2023 | 4 | | 📄✅ |
| Polygon Edge | Jan 2023 | 6 | | |
| Optimism | Dec 2022 | 8 | | |
| Paxos PayPal PYUSD | Dec 2022 | 1 | | 📄✅ |
| GSquared | Oct 2022 | 6 | | 📄✅ |
| Meson Protocol | Oct 2022 | 6 | | 📄✅ |
| Managed Pools | Oct 2022 | 4 | | 📄 |
| Ondo | Oct 2022 | 4 | | 📄✅ |
| Maple Protocol v2 | Sep 2022 | 8 | | 📄✅ |
| Increment Protocol | Sep 2022 | 4 | | 📄✅ |
| Subspace Farmer | Sep 2022 | 2 | | 📄✅|
| Optimism | Sep 2022 | 16 | | 📄 |
| Nayms | Sep 2022 | 6 | | |
| Aggregator | Aug 2022 | 2 | | |
| The Franchiser | Aug 2022 | 3 | | |
| Meson Protocol | Jul 2022 | 0.6 | | 📄 |
| ChainPort | Jul 2022 | 8 | | 📄✅ |
| Relay | Jul 2022 | 1 | | |
| Beanstalk | Jul 2022 | 8 | Beanstalk | 📄✅ |
| Purpose for Profit | Jul 2022 | 3 | | |
| Solon | Jul 2022 | 6 | | |
| Roll | Jul 2022 | 2 | | |
| Ante Protocol | May 2022 | 2 | | 📄✅ |
| Sherlock | Jun 2022 | 4 | | |
| FlareFinance | Jun 2022 | 4 | | |
| TBTv2 | Jun 2022 | 6 | | |
| Morpho | Jun 2022 | 4 | Morpho | 📄 |
| Relayer Contracts | Jun 2022 | 2 | | |
| AuctionRaffle | May 2022 | 2 | | |
| Seaport Protocol | May 2022 | 4 | OpenSea | 📄 |
| Shell Protocol v2 | May 2022 | 4 | | 📄 |
| Optimism | Apr 2022 | 6 | | |
| NFTX | Apr 2022 | 4 | NFTX | 📄 |
| ReserveLending+ | Apr 2022 | 4 | unFederalReserve | |
| Firefly | Apr 2022 | 4 | | |
| Maple Finance | Mar 2022 | 1 | | 📄✅ |
| Gyroscope | Mar 2022 | 6 | | |
| LooksRare | Mar 2022 | 4 | | 📄 |
| Symbiosis | Mar 2022 | 2 | | |
| RAILWAY | Feb 2022 | 4 | | |
| Persistence ETH2.0 | Feb 2022 | 4 | | |
| Advanced Blockchain | Feb 2022 | 6 | | 📄 |
| Perpetual Protocol V2 | Feb 2022 | 4 | | 📄 |
| Futureswap V4.1 | Feb 2022 | 4 | | |
| Firefly | Feb 2022 | 8 | | |
| API3 | Feb 2022 | 8 | | 📄 |
| Beethoven X | Feb 2022 | 1 | | 📄 |
| Minterest Finance | Jan 2022 | 6 | | |
| pSTAKE | Jan 2022 | 6 | | |
| Primitive | Jan 2022 | 8 | Primitive | 📄 |
| Strips Finance | Jan 2022 | 8 | | |
| Cardstack | Dec 2021 | 4 | | |
| Sherlock Protocol V2 | Dec 2021 | 4 | | 📄 |
| Maple | Nov 2021 | 4 | Maple | 📄 |
| Advanced Blockchain | Nov 2021 | 6 | | 📄 |
| Opyn | Nov 2021 | 6 | | 📄 |
| Aave V3 | Nov 2021 | 12 | | 📄✅ |
| Tokemak | Oct 2021 | 3 | | |
| Fuji Finance | Oct 2021 | 6 | | 📄 |
| V2 Vault | Oct 2021 | 4 | | |
| Yield V2 | Sep 2021 | 6 | | 📄 |
| Gro protocol | Sep 2021 | 2 | | |
| Futureswap V4 | Sep 2021 | 6 | | |
| RocketPool | Aug 2021 | 5 | | 📄 |
| AlphaX | Aug 2021 | 6 | | |
| Bug Bounty Platform | Aug 2021 | 8 | | |
| 88mph V3 | Aug 2021 | 6 | | 📄 |
| Timeswap | Jul 2021 | 2 | | |
| CompliFi | Jul 2021 | 6 | | 📄 |
| Optics | Jul 2021 | 2 | | |
| FlareFinance | Jun 2021 | 4 | | |
| Abyss Lockup | Jun 2021 | 2 | | |
| Futureswap V3 | Jun 2021 | 6 | | |
| CompliFi | Jun 2021 | 6 | | |
| Syndicate | May 2021 | 4 | | |
| Opyn Gamma | May 2021 | 6 | | 📄 |
| Yearn v2 Vaults | Apr 2021 | 6 | | 📄 |
| Balancer v2 | Apr 2021 | 4 | | 📄 |
| DFX Finance | Apr 2021 | 6 | | |
| Tokemak | Apr 2021 | 1 | | |
| Warp Contracts | Apr 2021 | 6 |Composable | 📄 |
| FlareFinance | Apr 2021 | 3 | | |
| MC Dai | Mar 2021 | 6 | | |
| dForce Lending | Mar 2021 | 6 | | |
| Liquity Proxy Contract | Feb 2021 | 0.57 | | 📄 |
| Liquity Protocol | Feb 2021 | 8 | | 📄|
| RAY-DAO | Feb 2021 | 4 | | |
| Futureswap | Jan 2021 | 2 | | |
| Balancer V2 | Jan 2021 | 6 | | |
| C.R.E.A.M. | Jan 2021 | 1 | | 📄 |
| LUSD | Dec 2020 | 8 | | 📄 |
| Origin Dollar | Nov 2020 | 4 | Origin Protocol | 📄 |
| Zerion SDK | Nov 2020 | 4 | | |
| Teller Protocol | Nov 2020 | 4 | | |
| Hermez | Nov 2020 | 4 | Hermez | 📄 |
| Graph Protocol | Oct 2020 | 3 | | |
| OVM | Oct 2020 | 6 | | |
| Prysm | Sep 2020 | 6 | | |
| DODO | Sep 2020 | 3 | | 📄 |
| Yield Protocol | Aug 2020 | 6 | | 📄 |
| Smart Pool | Aug 2020 | 1 | | |
| DeFiner | Aug 2020 | 1 | | |
| ETH2.0 Deposit CLI | Aug 2020 | 4 | | 📄|
| CurveDAO | Jul 2020 | 6 | | 📄 |
| Amp | Jul 2020 | 3 | | 📄 |
| Federated Bridge | Jul 2020 | 1 | | |
| dForce dToken | Jul 2020 | 2 | | 📄 |
| Matic | Jun 2020 | 4 | | |
| Lighthouse | Jun 2020 | 4 | | |
| tBTC | May 2020 | 6 | | 📄 |
| QTUM | Apr 2020 | 0.43 | | 📄 |
| Hegic | Apr 2020 | 0.43 | | 📄 |
| Golem Network | Mar 2020 | 2 | | |
| Reddit | Mar 2020 | 1 | A New Frontier | |
| Chai | Feb 2020 | 0.28 | | 📄 |
| Compound | Feb 2020 | 2 | | 📄 |
| WorkLock | Jan 2020 | 2 | NuCypher | 📄 |
| Balancer | Jan 2020 | 4 | | 📄 |
| Curve.fi | Jan 2020 | 1 | | 📄 |
| Livepeer | Oct 2019 | 3 | | |
| Topo Finance | Oct 2019 | 4 | | |
| 0x Protocol | Oct 2019 | 10 | | 📄 |
| Flexa | Sep 2019 | 2 | Flexa | 📄 |
| AZTEC Protocol | Sep 2019 | 10 | | 📄 |
| Oasis Labs | Sep 2019 | 13 | | |
| Aave Protocol | Sep 2019 | 4 | | 📄 |
| MC Dai | Aug 2019 | 13 | MakerDAO | 📄 |
| Staked | Aug 2019 | 4 | | |
| Compound | Aug 2019 | 2 | | 📄 |
| Computable | Jul 2019 | 8 | Computable | 📄 |
| Numerai | May 2019 | 3 | Numerai | 📄 |
| MerkleX | May 2019 | 4 | | |
| TokenCard | May 2019 | 5 | | 📄 |
| Unity Coin | Apr 2019 | 1 | | |
| Compound | Apr 2019 | 8 | Compound | 📄 |
| Ocean Protocol | Mar 2019 | 4 | Ocean Protocol | |
| UMA Project | Mar 2019 | 3 | | |
| Centrifuge | Mar 2019 | 5 | | |
| Nomisma | Mar 2019 | 1 | | |
| Set Protocol | Mar 2019 | 5 | Set Protocol | 📄 |
| NuCypher | Feb 2019 | 4 | NuCypher | 📄 |
| AMP StableWire | Jan 2019 | 1 | | |
| EIP-1283 | Jan 2019 | 1 | ChainSecurity | 📄 |
| Ampleforth | Nov 2018 | 4 | Ampleforth | 📄 |
| Origin Protocol | Nov 2018 | 4 | Origin Protocol | 📄 |
| Paxos Standard | Oct 2018 | 4 | | 📄 |
| Basecoin | Oct 2018 | 12 | | 📄 |
| Pantheon | Oct 2018 | 8 | PegaSys | 📄 |
| Compound | Sep 2018 | 12 | Compound | |
| NuCypher | Aug 2018 | 12 | NuCypher | 📄 |
| CENTRE | Jul 2018 | 4 | CENTRE |
| Bloom | Jul 2018 | 1 | Bloom |
| Gemini Dollar | Jun 2018 | 8 | Gemini | 📄 |
| Dharma | May 2018 | 1 | Dharma | |
| Golem | Apr 2018 | 4 | Golem | 📄 |
| LivePeer | Mar 2018 | 4 | Livepeer | 📄 |
| DappHub | Dec 2017 | 8 | | 📄 |
| MakerDAO Sai | Oct 2017 | 8 | MakerDAO | 📄 |
| Omega One | Aug 2017 | 6 | | |#### NervOS
Starknet
Solana
Substrate
Tendermint/Cosmos
Tezos
TON
其他/多链
披露与漏洞利用
另请查看漏洞利用仓库。
| 名称 | 产品 | 发现者 | 年份 | ID | 博客 |
|---|
| protobuf-python 中的拒绝服务 | protobuf-python | Alexis Challande | 2025 | CVE-2025-4565 | |
| 机密虚拟机中 LUKS2 磁盘加密的漏洞 | Linux LUKS2 | Tjaden Hess | 2025 | CVE-2025-59054, CVE-2025-58356 | 💬 |
| AI 智能体中的提示注入导致 RCE | AI 智能体（多平台） | Will Vandevanter | 2025 | ❌ | 💬 |
| Electron 应用中的代码完整性绕过 | Electron 应用（Signal、1Password、Slack） | Darius Houle | 2025 | CVE-2025-55305 | 💬 |
| 利用图像缩放攻击生产 AI 系统 | Google Gemini、Vertex AI、Genspark | Kikimora Morozova、Suha Sabi Hussain | 2025 | ❌ | 💬 |
阅读更多
