# Trail of Bits — full content index

> Cybersecurity research and engineering firm, founded in 2012. Below: the consulting service lines, the open-source tool catalog (with README excerpts), and the complete publications library.

## Services

### Software Assurance
- URL: https://trailofbits.com/services/software-assurance/
- Summary: Multi-disciplinary security reviews across the whole SDLC, with a team sized to your threat model rather than a fixed template.

### AI/ML Security
- URL: https://trailofbits.com/services/ai-ml/
- Summary: We review AI systems end to end, from training data and MLOps pipelines to model artifacts, inference hardware, and deployed agent loops.

### Application Security
- URL: https://trailofbits.com/services/application-security/
- Summary: Deep code, cloud, and architecture review that finds the root cause and the fix that retires the whole bug class.

### Blockchain
- URL: https://trailofbits.com/services/blockchain/
- Summary: We review every layer of a blockchain system, from smart contracts to nodes and bridges, backed by Slither, Echidna, and Medusa.

### Cryptography
- URL: https://trailofbits.com/services/cryptography/
- Summary: PhD-level cryptographers who build and break real protocols, from zero-knowledge proofs and MPC to post-quantum migrations.

### Security Engineering
- URL: https://trailofbits.com/services/security-engineering/
- Summary: An embedded team that builds custom security tooling and remediates vulnerabilities across your pipeline, from development through deployment.

### Research & Development
- URL: https://trailofbits.com/services/research-and-development/
- Summary: Multi-year research that uncovers Internet-scale vulnerabilities and turns the findings into open-source tools, papers, and standards.

## Organizations

- Trail of Bits: https://github.com/trailofbits — The main organization for tools, guides, publications, and ongoing engineering work.
- Crytic: https://github.com/crytic — Blockchain and smart-contract tooling, including Slither, Echidna, and Medusa.
- Lifting Bits: https://github.com/lifting-bits — Binary lifting, LLVM-based translation, and reverse-engineering infrastructure.
- Publications datasets: https://github.com/trailofbits/publications/tree/master/datasets — Structured public research assets, including audit-findings datasets that belong next to the tool catalog.

## Open-source tools

### Slither
- URL: https://trailofbits.com/tools/slither/
- Repository: https://github.com/crytic/slither
- Surface: Solidity / Vyper
- Best for: Fast pre-audit triage and continuous contract scanning.
- Summary: Static analysis for Solidity and Vyper with built-in detectors and an API for custom checks.
- README: > Slither is a Solidity & Vyper static analysis framework written in Python3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to easily write custom analyses. Slither enables developers to find vulnerabilities, enhance their code comprehension, and quickly prototype custom analyses.

### Echidna
- URL: https://trailofbits.com/tools/echidna/
- Repository: https://github.com/crytic/echidna
- Surface: Ethereum contracts
- Best for: Proving a contract holds its invariants before mainnet.
- Summary: Property-based fuzzer that throws grammar-driven inputs at Ethereum contracts to falsify your invariants.
- README: Echidna is a weird creature that eats bugs and is highly electrosensitive (with apologies to Jacob Stanley) More seriously, Echidna is a Haskell program designed for fuzzing/property-based testing of Ethereum smart contracts. It uses sophisticated grammar-based fuzzing campaigns based on a contract ABI to falsify user-defined predicates or Solidity assertions.

### Medusa
- URL: https://trailofbits.com/tools/medusa/
- Repository: https://github.com/crytic/medusa
- Surface: EVM / Go
- Best for: Teams that want higher-throughput fuzzing than a single local harness.
- Summary: Parallel smart-contract fuzzing built on go-ethereum and designed for large-scale test campaigns.
- README: medusa is a cross-platform go-ethereum-based smart contract fuzzer inspired by Echidna. It provides parallelized fuzz testing of smart contracts through CLI, or its Go API that allows custom user-extended testing methodology. Disclaimer: The Go-level testing API is still under development and is subject to breaking changes.

### Etheno
- URL: https://trailofbits.com/tools/etheno/
- Repository: https://github.com/crytic/etheno
- Surface: Ethereum testing
- Best for: Large multi-contract systems where tool orchestration becomes the problem.
- Summary: JSON-RPC multiplexer and test-integration layer for contract analysis tools.
- README: The repo is now archived. Use medusa for fuzzing. To learn more: https://secure-contracts.com/ Etheno is the Ethereum testing Swiss Army knife. It’s a JSON RPC multiplexer, analysis tool wrapper, and test integration tool. It eliminates the complexity of setting up analysis tools like Echidna on large, multi-contract projects. If you are a smart contract developer, you should use Etheno to test your contracts.

### Tealer
- URL: https://trailofbits.com/tools/tealer/
- Repository: https://github.com/crytic/tealer
- Surface: Algorand / TEAL
- Best for: Reviewing contracts outside the Ethereum stack without giving up automation.
- Summary: Static analysis for Algorand TEAL programs with CFG construction and vulnerability detectors.
- README: Tealer is a static analyzer for Teal code. It parses the Teal program, and builds its CFG. The analyzer comes with a set of vulnerabilities detectors and printers allowing to quickly review the contracts. In addition, tealer allows for custom path discovery through regular expression, and can be configured to follow the group information of the application.

### Circomspect
- URL: https://trailofbits.com/tools/circomspect/
- Repository: https://github.com/trailofbits/circomspect
- Surface: Circom circuits
- Best for: Protocol teams building zk systems that need early circuit review feedback.
- Summary: Static analysis and linting for Circom circuits, aimed at catching risky patterns in zero-knowledge code.
- README: Circomspect is a static analyzer and linter for the Circom programming language. The codebase borrows heavily from the Rust Circom compiler built by iden3. Circomspect currently implements a number of analysis passes which can identify potential issues in Circom circuits. It is our goal to continue to add new analysis passes to be able to detect more issues in the future.

### Remill
- URL: https://trailofbits.com/tools/remill/
- Repository: https://github.com/lifting-bits/remill
- Surface: x86 / ARM / SPARC
- Best for: Recovering analyzable program structure from raw instructions.
- Summary: Machine-code lifter that translates instructions into LLVM bitcode for later analysis and transformation.
- README: Remill is a static binary translator that translates machine code instructions into LLVM bitcode. It translates AArch64 (64-bit ARMv8), SPARC32 (SPARCv8), SPARC64 (SPARCv9), x86 and amd64 machine code (including AVX and AVX512) into LLVM bitcode. AArch32 (32-bit ARMv8 / ARMv7) support is underway. Remill focuses on accurately lifting instructions. It is meant to be used as a library for other tools, e.g. McSema.

### Anvill
- URL: https://trailofbits.com/tools/anvill/
- Repository: https://github.com/lifting-bits/anvill
- Surface: Machine code to LLVM
- Best for: When downstream decompilation quality matters as much as correctness.
- Summary: Lifting primitives that aim for Clang-like bitcode quality so decompiled output is easier to reason about.
- README: Anvill implements simple machine code lifting primitives using Remill. The goal of these components is to produce high quality bitcode, which can then be further decompiled to C (via Clang ASTs) using Rellic. We define "high quality bitcode" as being similar in form to what the Clang compiler would produce if it were executed on a semantically equivalent C function.

### VMill
- URL: https://trailofbits.com/tools/vmill/
- Repository: https://github.com/lifting-bits/vmill
- Surface: Execution snapshots
- Best for: Reproducing binary behavior from captured process state.
- Summary: Snapshot-based process emulator for executing lifted binaries and instrumenting them in LLVM form.
- README: VMill is a snapshot-based process emulator. It just-in-time lifts machine code to LLVM bitcode, and enables that bitcodet to be instrumented. That bitcode is then compiled to machine code and executed. If you are experiencing undocumented problems with Remill then ask for help in the #binary-lifting channel of the Empire Hacking Slack. Remill is supported on Linux platforms and has been tested on debian testing.

### Manticore
- URL: https://trailofbits.com/tools/manticore/
- Repository: https://github.com/trailofbits/manticore
- Surface: Binaries / EVM / Wasm
- Best for: Custom analyses where you need path exploration rather than point tooling.
- Summary: Symbolic execution engine for binaries, smart contracts, and WebAssembly programs.
- README: This project is no longer internally developed and maintained. However, we are happy to review and accept small, well-written pull requests by the community. We will only consider bug fixes and minor enhancements. Any new or currently open issues and discussions shall be answered and supported by the community. Manticore is a symbolic execution tool for the analysis of smart contracts and binaries.

### Maat
- URL: https://trailofbits.com/tools/maat/
- Repository: https://github.com/trailofbits/maat
- Surface: Binary analysis
- Best for: Research-heavy workflows that need more control than a single-purpose UI.
- Summary: Dynamic symbolic execution and binary-analysis framework with taint analysis, environment simulation, and constraint solving.
- README: Maat is an open-source Dynamic Symbolic Execution and Binary Analysis framework. It provides symbolic execution, taint analysis, constraint solving, binary loading, and environment simulation, and leverages Ghidra's sleigh library for assembly lifting (https://maat.re).

### Codex Decompiler
- URL: https://trailofbits.com/tools/codex-decompiler/
- Repository: https://github.com/trailofbits/Codex-Decompiler
- Surface: Ghidra plugin
- Best for: Analysts experimenting with assisted lifting and vulnerability-oriented code explanation.
- Summary: Ghidra plugin that uses language models to improve decompilation and reverse-engineering workflows.
- README: This project was built by Akshat Parikh during the Trail of Bits 2022 Winter Internship. The project is provided as is. Contact opensource@trailofbits.com if you'd like to use this project. Codex Decompiler is a Ghidra plugin that utilizes OpenAI's models to improve the decompilation and reverse engineering experience.

### DeepState
- URL: https://trailofbits.com/tools/deepstate/
- Repository: https://github.com/trailofbits/deepstate
- Surface: C / C++
- Best for: Teams that want one harness to travel across several testing engines.
- Summary: Common interface for C and C++ tests across multiple fuzzing and symbolic-execution backends.
- README: DeepState is a framework that provides C and C++ developers with a common interface to various symbolic execution and fuzzing engines. Users can write one test harness using a Google Test-like API, then execute it using multiple backends without having to learn the complexities of the underlying engines. It supports writing unit tests and API sequence tests, as well as automatic test generation.

### gosentry
- URL: https://trailofbits.com/tools/gosentry/
- Repository: https://github.com/trailofbits/gosentry
- Surface: Go fuzzing
- Best for: Running stronger Go fuzzing campaigns through the familiar go test -fuzz workflow.
- Summary: Security-focused Go toolchain fork that adds LibAFL fuzzing, structured inputs, grammar mode, and fuzz-time bug detectors.
- README: gosentry is a security-focused fork of the Go toolchain that adds state-of-the-art fuzzing features for Go codebases. It works as a replacement for go test -fuzz and includes fuzzing improvements and bug detectors that are not present in the native Go toolchain.

### zfuzz
- URL: https://trailofbits.com/tools/zfuzz/
- Repository: https://github.com/trailofbits/zfuzz
- Surface: Snapshots / memory dumps
- Best for: Firmware or embedded targets where standing up a normal harness is too expensive.
- Summary: Emulation-based snapshot fuzzer that can load arbitrary memory dumps and attack them directly.
- README: This project was built by Gilbert Hoermann during the Trail of Bits 2022 Winter Internship. The project is provided as is. Contact opensource@trailofbits.com if you'd like to use this project. Emulation based snapshot fuzzer. Can load arbitrary memory dumps and start fuzzing. Provides a mutational and a generationl grammar based mutator. The repo currently contains 2 test-cases that the fuzzer is harnessed for.

### KRF
- URL: https://trailofbits.com/tools/krf/
- Repository: https://github.com/trailofbits/krf
- Surface: Kernel testing
- Best for: Assessing whether system software fails safely under stress.
- Summary: Kernel fault-injection tool for Linux and FreeBSD designed to force error paths and expose weak handling.
- README: KRF === KRF is a Kernelspace Randomized Faulter. It currently supports the Linux and FreeBSD kernels. Fault injection is a software testing technique that involves inducing failures ("faults") in the functions called by a program. If the callee has failed to perform proper error checking and handling, these faults can result in unreliable application behavior or exploitable vulnerabilities.

### ProtoFuzz
- URL: https://trailofbits.com/tools/protofuzz/
- Repository: https://github.com/trailofbits/protofuzz
- Surface: Protocol Buffers
- Best for: Message-based systems where structure matters more than raw byte mutation.
- Summary: Grammar-aware fuzzer for Protocol Buffers that derives inputs from format definitions rather than hand-written generators.
- README: ProtoFuzz is a generic fuzzer for Google’s Protocol Buffers format. Instead of defining a new fuzzer generator for custom binary formats, protofuzz automatically creates a fuzzer based on the same format definition that programs use. ProtoFuzz is implemented as a stand-alone Python3 program.

### test-fuzz
- URL: https://trailofbits.com/tools/test-fuzz/
- Repository: https://github.com/trailofbits/test-fuzz
- Surface: Rust
- Best for: Lowering the setup cost enough that fuzzing becomes a normal part of development.
- Summary: Rust macros and Cargo tooling that automate corpus creation and harness setup for fuzzing.
- README: test-fuzz is a Cargo subcommand and a collection of Rust macros to automate certain tasks related to fuzzing with [afl.rs], including: test-fuzz accomplishes these (in part) using Rust's testing facilities. For example, to generate a fuzzing corpus, test-fuzz records a target's arguments each time it is called during an invocation of cargo test.

### Necessist
- URL: https://trailofbits.com/tools/necessist/
- Repository: https://github.com/trailofbits/necessist
- Surface: Rust test suites
- Best for: Finding false confidence in existing tests rather than just adding more coverage.
- Summary: Mutation-style tool that removes statements and calls to uncover tests that look healthy but are actually weak.
- README: Run tests with statements and method calls removed to help identify broken tests Necessist currently supports Anchor, Foundry, Go, Hardhat, PHP, Rust, and Vitest. A paper on Necessist ([Test Harness Mutilation]) appeared in Mutation 2024.

### Mewt
- URL: https://trailofbits.com/tools/mewt/
- Repository: https://github.com/trailofbits/mewt
- Surface: C++ / Go / JS/TS / Rust / Solidity / Sui Move
- Best for: Finding gaps that coverage misses by checking whether tests fail when supported code is mutated.
- Summary: Mutation testing framework that makes small source-code changes and runs your test suite to show whether tests catch real behavioral changes.
- README: Mewt is a mutation testing tool and framework that finds gaps in tests that coverage metrics miss. It mutates source code, runs the test suite, and reports whether tests catch the behavioral changes. Mewt supports C++, Go, JavaScript, TypeScript, Rust, Solidity, and Sui Move.

### rekor-monitor
- URL: https://trailofbits.com/tools/rekor-monitor/
- Repository: https://github.com/sigstore/rekor-monitor
- Surface: Sigstore / provenance
- Best for: Alerting on compromised release identities instead of discovering problems after distribution.
- Summary: Transparency-log monitoring for Sigstore's Rekor so maintainers can watch for suspicious signing events.
- README: Rekor Log Monitor provides an easy-to-use monitor to verify log consistency, that the log is immutable and append-only. Monitoring is critical to the transparency log ecosystem, as logs are tamper-evident but not tamper-proof. Rekor Log Monitor also provides a monitor to search for identities within a log, and send a list of found identities via various notification platforms.

### It-Depends
- URL: https://trailofbits.com/tools/it-depends/
- Repository: https://github.com/trailofbits/it-depends
- Surface: SBOM / dependencies
- Best for: Understanding third-party exposure before software ships.
- Summary: Dependency-graph and SBOM builder for packages and arbitrary source repositories.
- README: It-Depends is a tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories. It supports Go, JavaScript, Rust, Python, C/C++ (cmake and autotools), and Ubuntu packages.

### cargo-unmaintained
- URL: https://trailofbits.com/tools/cargo-unmaintained/
- Repository: https://github.com/trailofbits/cargo-unmaintained
- Surface: Cargo
- Best for: Catching dependency drift during review instead of after abandonment is obvious.
- Summary: Identifies unmaintained packages in Rust projects before they quietly become inherited risk.
- README: Find unmaintained packages in Rust projects cargo-unmaintained is similar to [cargo-audit]. However, cargo-unmaintained finds unmaintained packages automatically using heuristics, rather than rely on users to manually submit them to the [RustSec Advisory Database]. cargo-unmaintained defines an unmaintained package X as one that satisfies one of 1 through 3 below: 1. X's repository is archived (see [Notes] below).

### Dylint
- URL: https://trailofbits.com/tools/dylint/
- Repository: https://github.com/trailofbits/dylint
- Surface: Rust policy
- Best for: Encoding organization-specific security rules directly into the toolchain.
- Summary: Runs custom Rust lints from dynamic libraries rather than a single fixed lint set.
- README: Run Rust lints from dynamic libraries (EuroRust 2024 [slides] and [video]) Dylint is a Rust linting tool, similar to Clippy. But whereas Clippy runs a predetermined, static set of lints, Dylint runs lints from user-specified, dynamic libraries. Thus, Dylint allows developers to maintain their own personal lint collections. Contents Documentation is also available on [how Dylint works].

### semgrep-rules
- URL: https://trailofbits.com/tools/semgrep-rules/
- Repository: https://github.com/trailofbits/semgrep-rules
- Surface: Static analysis
- Best for: Fast pattern-based checks you can drop into CI with minimal scaffolding.
- Summary: Public Semgrep queries developed during audits, research, and internal engineering work.
- README: This repository contains Semgrep rules developed by Trail of Bits and made available to the public. They are part of our ongoing development efforts and are used in our security audits, vulnerability reseach, and internal projects. They will evolve over time as we identify new techniques. Visit Testing Handbook for Semgrep guidance. The easiest way to run the rules is to run them from the Semgrep registry.

### codeql-queries
- URL: https://trailofbits.com/tools/codeql-queries/
- Repository: https://github.com/trailofbits/codeql-queries
- Surface: CodeQL
- Best for: Teams that need richer semantic checks than regex-shaped rules can offer.
- Summary: Public CodeQL query packs used to express deeper code and data-flow policies.
- README: This repository contains CodeQL queries developed by Trail of Bits and made available to the public. They are part of our ongoing development efforts and are used in our security audits, vulnerability research, and internal projects. They will evolve over time as we identify new techniques. See QUERIES.md for the full list of queries. CodeQL queries are grouped into suites.

### Linuxevents
- URL: https://trailofbits.com/tools/linuxevents/
- Repository: https://github.com/trailofbits/linuxevents
- Surface: Linux / eBPF
- Best for: Collecting process and network telemetry with fewer deployment assumptions.
- Summary: eBPF-based monitoring without shipping kernel headers or a stack of environment-specific bytecode artifacts.
- README: This is a proof-of-concept for a container-aware process and network event publisher library with no runtime dependencies (i.e. kernel headers). It works by using LLVM/Clang, the BTF debug information (btfparse) and our C++ BPF utilities (ebpf-common). 1. Download and extract the osquery-toolchain 2. Clone the repository: git clone --recursive https://github.com/trailofbits/linuxevents 3.

### ebpfpub
- URL: https://trailofbits.com/tools/ebpfpub/
- Repository: https://github.com/trailofbits/ebpfpub
- Surface: Linux / eBPF
- Best for: Users who need compatibility with older kernels as well as newer ones.
- Summary: Monitors system and library calls across multiple kernel versions with minimal runtime dependencies.
- README: ebpfpub is a generic function tracing library for Linux that supports tracepoints, kprobes and uprobes. As root: 1. Obtain the source code: git clone --recursive https://github.com/trailofbits/ebpfpub 2. If you cloned the repo without the --recursive flag, run git submodule update --init --recursive 3. Enter the source folder: cd ebpfpub 4.

### ebpf-verifier
- URL: https://trailofbits.com/tools/ebpf-verifier/
- Repository: https://github.com/trailofbits/ebpf-verifier
- Surface: Kernel CI
- Best for: Reducing verifier-specific surprises before deployment.
- Summary: Research prototype for running the eBPF verifier outside the live kernel to make cross-version testing practical.
- README: The eBPF Verifier Harness project seeks to isolate the eBPF verifier from the Linux kernel in order to allow efficient checks that an eBPF program will run on various kernel versions and configurations. It will also allow for detecting discrepencies in the eBPF verifier between different kernel versions. 1. linux/src: git submodule of linux src 2. libbpf/src: git submodule of libbpf mirror src 3.

### mquire
- URL: https://trailofbits.com/tools/mquire/
- Repository: https://github.com/trailofbits/mquire
- Surface: Linux memory snapshots
- Best for: Incident response and forensics against unknown or custom kernels where shipping matching debug symbols is impractical.
- Summary: Memory-forensics tool that queries Linux kernel snapshots over SQL, using BTF and kallsyms embedded in the dump so no external debug symbols are needed.

### winchecksec
- URL: https://trailofbits.com/tools/winchecksec/
- Repository: https://github.com/trailofbits/winchecksec
- Surface: PE security
- Best for: Quickly checking whether release artifacts actually picked up the hardening you expect.
- Summary: Static inspection of Windows binaries for mitigations like DEP, ASLR, and code integrity.
- README: winchecksec =========== winchecksec performs static detection of common Windows security features. The following security features are currently detected: winchecksec depends on pe-parse and uthenticode, which can be installed via vcpkg: NOTE: On Windows, vcpkg defaults to 32-bit builds.

### pe-parse
- URL: https://trailofbits.com/tools/pe-parse/
- Repository: https://github.com/trailofbits/pe-parse
- Surface: Portable Executable
- Best for: Toolchains that need reliable PE introspection as a foundation.
- Summary: Minimal, security-focused parser for Portable Executable files built to survive malicious or malformed inputs.
- README: pe-parse is a principled, lightweight parser for Windows portable executable files. It was created to assist in compiled program analysis, potentially of programs of unknown origins. This means that it should be resistant to malformed or maliciously crafted PE files, and it should support questions that analysis software would ask of an executable program container.

### osquery-extensions
- URL: https://trailofbits.com/tools/osquery-extensions/
- Repository: https://github.com/trailofbits/osquery-extensions
- Surface: Endpoint telemetry
- Best for: Teams already invested in osquery who want deeper endpoint coverage.
- Summary: Collection of Trail of Bits extensions that expand what osquery can inspect and expose.
- README: This repository includes osquery extensions developed and maintained by Trail of Bits. If you would like to sponsor the development of an extension, please contact us. Extensions are a type of osquery add-on that can be loaded at runtime to provide new virtual tables. The extensions interface allows organizations to implement proprietary detection methods, or address their individual needs.

### Graphtage
- URL: https://trailofbits.com/tools/graphtage/
- Repository: https://github.com/trailofbits/graphtage
- Surface: Structured data
- Best for: Cases where text diffs hide the actual meaning of a change.
- Summary: Semantic diff and merge tooling for tree-shaped data such as JSON, YAML, HTML, plist, and CSS.
- README: Graphtage is a command-line utility and underlying library for semantically comparing and merging tree-like structures, such as JSON, XML, HTML, YAML, plist, and CSS files. Its name is a portmanteau of “graph” and “graftage”—the latter being the horticultural practice of joining two trees together such that they grow as one.

### Polyfile
- URL: https://trailofbits.com/tools/polyfile/
- Repository: https://github.com/trailofbits/polyfile
- Surface: File formats
- Best for: Investigating weird files before trusting a parser chain.
- Summary: Maps the semantic structure of files, including polyglots and other intentionally confusing inputs.
- README: A utility to identify and map the semantic and syntactic structure of files, including polyglots, chimeras, and schizophrenic files. It has a pure-Python implementation of libmagic and can act as a drop-in replacement for the file command. However, unlike file, PolyFile can recursively identify embedded files, like binwalk.

### PolyTracker
- URL: https://trailofbits.com/tools/polytracker/
- Repository: https://github.com/trailofbits/polytracker
- Surface: Data provenance
- Best for: Understanding how parsers and binary-processing code actually consume untrusted inputs.
- Summary: LLVM-based data-flow and control-flow analysis that records how program logic touches specific input bytes.
- README: PolyTracker is a tool originally created for the Automated Lexical Annotation and Navigation of Parsers, a backronym devised solely for the purpose of referring to it as The ALAN Parsers Project. However, it has evolved into a general purpose tool for efficiently performing data-flow and control-flow analysis of programs.

### Umberto
- URL: https://trailofbits.com/tools/umberto/
- Repository: https://github.com/trailofbits/umberto
- Surface: Grammar-based mutation
- Best for: Fuzzing scenarios where preserving structure is more valuable than raw noise.
- Summary: Structured-data mutator for JSON, XML, X.509, and other grammar-shaped inputs.
- README: Umberto is a library designed for mutating generic structured data (e.g., JSON, XML, X.509) and a command line application wrapping this functionality. It can apply a variety of mutations, synthesize totally new values, and apply existing mutators (e.g. Radamsa) to structure components. If you're trying to perform grammar-based fuzzing, you might find it very useful.

### mishegos
- URL: https://trailofbits.com/tools/mishegos/
- Repository: https://github.com/trailofbits/mishegos
- Surface: Instruction decoders
- Best for: Finding gaps in the binary-analysis stack itself.
- Summary: Differential fuzzer for x86 decoders built to expose disagreements between analysis tools.
- README: mishegos ======== A differential fuzzer for x86 decoders. Read more about mishegos in its accompanying blog post and academic publication (paper Start with a clone, including submodules: mishegos is most easily built within Docker: Alternatively, you can try building it directly.

### Honeybee
- URL: https://trailofbits.com/tools/honeybee/
- Repository: https://github.com/trailofbits/honeybee
- Surface: Trace decoding
- Best for: Research-grade tracing workflows where normal instrumentation is too slow.
- Summary: Intel Processor Trace capture and decoding suite tuned for high-throughput source and blackbox fuzzing.
- README: Honeybee is a very fast Intel Processor Trace capture and decoding suite which enables previously unattainable performance in source and blackbox fuzzing alike by taking advantage of a custom ahead-of-time analysis cache to accelerate decoding multiple traces. This repo contains a handful of sub-projects.

### Fickling
- URL: https://trailofbits.com/tools/fickling/
- Repository: https://github.com/trailofbits/fickling
- Surface: Python pickle / ML models
- Best for: Scanning untrusted model files before you load them.
- Summary: Decompiles, statically analyzes, and rewrites Python pickle files to catch code hidden in ML model artifacts.
- README: Fickling is a decompiler, static analyzer, and bytecode rewriter for Python pickle object serializations. You can use fickling to detect, analyze, reverse engineer, or even create malicious pickle or pickle-based files, including PyTorch files. Fickling can be used both as a python library and a CLI. Fickling has been tested on Python 3.9 through Python 3.13 and has very few dependencies.

### PrivacyRaven
- URL: https://trailofbits.com/tools/privacyraven/
- Repository: https://github.com/trailofbits/privacyraven
- Surface: ML privacy
- Best for: Measuring whether a model leaks more than a team expects.
- Summary: Privacy-testing library for deep-learning systems and privacy-preserving ML techniques.
- README: Note: This project is on hiatus. PrivacyRaven is a privacy testing library for deep learning systems. You can use it to determine the susceptibility of a model to different privacy attacks; evaluate privacy preserving machine learning techniques; develop novel privacy metrics and attacks; and repurpose attacks for data provenance and other use cases.

### MPC-learning
- URL: https://trailofbits.com/tools/mpc-learning/
- Repository: https://github.com/trailofbits/mpc-learning
- Surface: ML / cryptography
- Best for: Research contexts where privacy-preserving model computation matters.
- Summary: Multi-party computation library for machine-learning workflows built around a three-party protocol.
- README: MPC-learning is a Python library for performing multi-party computation on machine learning applications. This library implements the 3-party computation protocol of https://eprint.iacr.org/2016/768.pdf . For now, a "dealer" is required to distribute shares of inputs, and the protocol can only be run locally (does not support networking yet). This is a quick guide to getting this repo up and running for development.

### abi3audit
- URL: https://trailofbits.com/tools/abi3audit/
- Repository: https://github.com/trailofbits/abi3audit
- Surface: Python packaging
- Best for: Catching binary-compatibility mistakes before they become user breakage.
- Summary: Scans Python extensions and wheels for abi3 compatibility violations across package histories.
- README: Read the Trail of Bits blog post about finding bugs with abi3audit! abi3audit scans Python extensions for abi3 violations and inconsistencies. It can scan individual (unpackaged) shared objects, packaged wheels, or entire package version histories. This project was created by Trail of Bits and is now maintained as part of the Python Packaging Authority (PyPA). This is not an official Trail of Bits product.

### CVEdb
- URL: https://trailofbits.com/tools/cvedb/
- Repository: https://github.com/trailofbits/cvedb
- Surface: Vulnerability lookup
- Best for: Offline-friendly triage and local enrichment workflows.
- Summary: Library and CLI for consuming NVD data directly without leaning on third-party APIs.
- README: CVEdb is yet another Python CVE database library and utility. There are lots already available. Why create another? Most existing libraries rely on a third party API like cve.circl.lu, which can and do throttle usage, require registration, and/or demand an internet connection. Some libraries are bloated, including web interfaces for search.

## Publications library

- let-fate-decide (Claude Code skill · 2026-05) — https://github.com/trailofbits/skills/tree/main/plugins/let-fate-decide/skills/let-fate-decide
- solana-vulnerability-scanner (Claude Code skill · 2026-05) — https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner
- c-review (Claude Code skill · 2026-05) — https://github.com/trailofbits/skills/tree/main/plugins/c-review/skills/c-review
- Kiln Lagoon Vault Diff Review (Security review · Kiln · 2026-05 · Blockchain) — https://trailofbits.com/library/kiln-lagoon-vault-diff-review/
- audit-augmentation (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/audit-augmentation
- devcontainer-setup (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/devcontainer-setup/skills/devcontainer-setup
- diagramming-code (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/diagramming-code
- differential-review (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/differential-review/skills/differential-review
- genotoxic (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/genotoxic
- graph-evolution (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/graph-evolution
- sharp-edges (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/sharp-edges/skills/sharp-edges
- trailmark (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/trailmark
- trailmark-structural (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/trailmark-structural
- trailmark-summary (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/trailmark-summary
- agentic-actions-auditor (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/agentic-actions-auditor/skills/agentic-actions-auditor
- burpsuite-project-parser (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/burpsuite-project-parser/skills/burpsuite-project-parser
- codeql (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/static-analysis/skills/codeql
- designing-workflow-skills (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/workflow-skill-design/skills/designing-workflow-skills
- dimensional-analysis (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/dimensional-analysis/skills/dimensional-analysis
- dwarf-expert (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/dwarf-expert/skills/dwarf-expert
- entry-point-analyzer (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/entry-point-analyzer/skills/entry-point-analyzer
- firebase-apk-scanner (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/firebase-apk-scanner/skills/firebase-apk-scanner
- fp-check (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/fp-check/skills/fp-check
- git-cleanup (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/git-cleanup/skills/git-cleanup
- insecure-defaults (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/insecure-defaults/skills/insecure-defaults
- interpreting-culture-index (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/culture-index/skills/interpreting-culture-index
- mutation-testing (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/mutation-testing/skills/mutation-testing
- sarif-parsing (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/static-analysis/skills/sarif-parsing
- seatbelt-sandboxer (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/seatbelt-sandboxer/skills/seatbelt-sandboxer
- second-opinion (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/second-opinion/skills/second-opinion
- semgrep (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/static-analysis/skills/semgrep
- semgrep-rule-creator (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/semgrep-rule-creator/skills/semgrep-rule-creator
- semgrep-rule-variant-creator (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/semgrep-rule-variant-creator/skills/semgrep-rule-variant-creator
- skill-improver (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/skill-improver/skills/skill-improver
- supply-chain-risk-auditor (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor
- zeroize-audit (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/zeroize-audit/skills/zeroize-audit
- Ripple Labs XRP Ledger Confidential Transfer (Security review · Ripple Labs · 2026-04 · Crypto) — https://trailofbits.com/library/ripple-labs-xrp-ledger-confidential-transfer/
- PyPI Warehouse (Security review · Sovereign Tech Agency · 2026-04 · Supply Chain) — https://trailofbits.com/library/pypi-warehouse/
- Franklin Templeton BenjiSwap Differential Review (Security review · Franklin Templeton · 2026-04 · Blockchain) — https://trailofbits.com/library/franklin-templeton-benjiswap-differential-review/
- Gensyn Buyback-and-Burn Vault (Security review · Gensyn · 2026-04 · Blockchain) — https://trailofbits.com/library/gensyn-buyback-and-burn-vault/
- Gensyn Bridged Token (Security review · Gensyn · 2026-04 · Blockchain) — https://trailofbits.com/library/gensyn-bridged-token/
- Gensyn Delphi Dynamic Paramutuel Markets (Security review · Gensyn · 2026-04 · Blockchain) — https://trailofbits.com/library/gensyn-delphi-dynamic-paramutuel-markets/
- cosmos-vulnerability-scanner (Claude Code skill · 2026-04) — https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner
- crypto-protocol-diagram (Claude Code skill · 2026-03) — https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/crypto-protocol-diagram
- mermaid-to-proverif (Claude Code skill · 2026-03) — https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/mermaid-to-proverif
- vector-forge (Claude Code skill · 2026-03) — https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/vector-forge
- aflpp (Claude Code skill · 2026-03) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/aflpp
- gh-cli (Claude Code skill · 2026-03) — https://github.com/trailofbits/skills/tree/main/.codex/skills/gh-cli
- Open Home Foundation SecureTar v3 (Security review · Open Home Foundation · 2026-03 · Crypto) — https://trailofbits.com/library/open-home-foundation-securetar-v3/
- Anza BLS Signatures (Security review · Anza · 2026-03 · Crypto) — https://trailofbits.com/library/anza-bls-signatures/
- Shape TokenLock (Security review · Shape Factory · 2026-03 · Blockchain) — https://trailofbits.com/library/shape-tokenlock/
- EthStaker Deposit CLI (Security review · EthStaker · 2026-03 · Blockchain) — https://trailofbits.com/library/ethstaker-deposit-cli/
- testing-handbook-generator (Claude Code skill · 2026-02) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/testing-handbook-generator
- variant-analysis (Claude Code skill · 2026-02) — https://github.com/trailofbits/skills/tree/main/plugins/variant-analysis/skills/variant-analysis
- audit-context-building (Claude Code skill · 2026-02) — https://github.com/trailofbits/skills/tree/main/plugins/audit-context-building/skills/audit-context-building
- spec-to-code-compliance (Claude Code skill · 2026-02) — https://github.com/trailofbits/skills/tree/main/plugins/spec-to-code-compliance/skills/spec-to-code-compliance
- debug-buttercup (Claude Code skill · 2026-02) — https://github.com/trailofbits/skills/tree/main/plugins/debug-buttercup/skills/debug-buttercup
- property-based-testing (Claude Code skill · 2026-02) — https://github.com/trailofbits/skills/tree/main/plugins/property-based-testing/skills/property-based-testing
- Finding Hidden Overflows in Go: Fuzzing Beyond the Compiler's Limits (Conference talk · 2026-02 · Systems) — https://trailofbits.com/library/finding-hidden-overflows-in-go-fuzzing-beyond-the-compiler-s-limits/
- Risky Biz (Podcast · 2026-02) — https://trailofbits.com/library/risky-biz/
- What's in the SOSS? 53 (Podcast · 2026-02) — https://trailofbits.com/library/what-s-in-the-soss-53/
- Offchain Labs Arbitrum Quorum Changes (Security review · Offchain Labs · 2026-02 · Blockchain) — https://trailofbits.com/library/offchain-labs-arbitrum-quorum-changes/
- NEAR One Robust ECDSA (Security review · NEAR One · 2026-02 · Crypto) — https://trailofbits.com/library/near-one-robust-ecdsa/
- DV Labs Charon Pedersen DKG (Security review · DV Labs · 2026-02 · Crypto) — https://trailofbits.com/library/dv-labs-charon-pedersen-dkg/
- Aave v4 (Security review · Aave · 2026-02 · Blockchain) — https://trailofbits.com/library/aave-v4/
- Chainlink LlamaRisk LlamaGuard NAV CRE (Security review · LlamaRisk · 2026-02 · Blockchain) — https://trailofbits.com/library/chainlink-llamarisk-llamaguard-nav-cre/
- yara-rule-authoring (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/yara-authoring/skills/yara-rule-authoring
- algorand-vulnerability-scanner (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner
- ask-questions-if-underspecified (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/ask-questions-if-underspecified/skills/ask-questions-if-underspecified
- audit-prep-assistant (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/audit-prep-assistant
- cairo-vulnerability-scanner (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner
- code-maturity-assessor (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/code-maturity-assessor
- guidelines-advisor (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/guidelines-advisor
- modern-python (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/modern-python/skills/modern-python
- secure-workflow-guide (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/secure-workflow-guide
- substrate-vulnerability-scanner (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner
- token-integration-analyzer (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/token-integration-analyzer
- ton-vulnerability-scanner (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner
- claude-in-chrome-troubleshooting (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/claude-in-chrome-troubleshooting/skills/claude-in-chrome-troubleshooting
- address-sanitizer (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/address-sanitizer
- atheris (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/atheris
- cargo-fuzz (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/cargo-fuzz
- constant-time-analysis (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/constant-time-analysis/skills/constant-time-analysis
- constant-time-testing (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/constant-time-testing
- coverage-analysis (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/coverage-analysis
- fuzzing-dictionary (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/fuzzing-dictionary
- fuzzing-obstacles (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/fuzzing-obstacles
- harness-writing (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/harness-writing
- libafl (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/libafl
- libfuzzer (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/libfuzzer
- ossfuzz (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/ossfuzz
- ruzzy (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/ruzzy
- wycheproof (Claude Code skill · 2026-01) — https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/wycheproof
- How we made Trail of Bits AI-Native (so far) (Conference talk · 2026 · AI/ML) — https://trailofbits.com/library/how-we-made-trail-of-bits-ai-native-so-far/
- Offchain Labs Arbitrum Nitro External DA (Security review · Offchain Labs · 2026-01 · Blockchain) — https://trailofbits.com/library/offchain-labs-arbitrum-nitro-external-da/
- Anza Token-2022 Confidential Transfer, Cryptography (Security review · Anza · 2026-01 · Crypto) — https://trailofbits.com/library/anza-token-2022-confidential-transfer-cryptography/
- Calyx Institute HSM Provisioning Ceremony Scripts (Security review · Calyx Institute · 2026-01 · Crypto) — https://trailofbits.com/library/calyx-institute-hsm-provisioning-ceremony-scripts/
- BSV Blockchain TS-SDK (Security review · BSV Association · 2026-01 · Crypto) — https://trailofbits.com/library/bsv-blockchain-ts-sdk/
- Bron Labs MCP Library (Security review · Bron Labs · 2026-01 · Crypto) — https://trailofbits.com/library/bron-labs-mcp-library/
- Anza Token-2022 Confidential Transfer, Blockchain (Security review · Anza · 2026-01 · Blockchain) — https://trailofbits.com/library/anza-token-2022-confidential-transfer-blockchain/
- TONCO CLAMM DEX v1.6 (Security review · TONCO · 2026-01 · Blockchain) — https://trailofbits.com/library/tonco-clamm-dex-v1-6/
- Insecure Agents 18 (Podcast · 2025-12) — https://trailofbits.com/library/insecure-agents-18/
- Top TEE bugs you should fix before your audit (Webinar · 2025-12) — https://trailofbits.com/library/top-tee-bugs-you-should-fix-before-your-audit/
- Building secure end-to-end encrypted systems (Webinar · 2025-12) — https://trailofbits.com/library/building-secure-end-to-end-encrypted-systems/
- Offchain Labs Arbitrum ArbOS 50 and 51 (Fusaka) (Security review · Offchain Labs · 2025-12 · Blockchain) — https://trailofbits.com/library/offchain-labs-arbitrum-arbos-50-and-51-fusaka/
- Offchain Labs Arbitrum Chains Genesis File Generator (Security review · Offchain Labs · 2025-12 · Blockchain) — https://trailofbits.com/library/offchain-labs-arbitrum-chains-genesis-file-generator/
- NEAR One Confidential Key Derivation (Security review · NEAR One · 2025-12 · Crypto) — https://trailofbits.com/library/near-one-confidential-key-derivation/
- After Wiretap and Battering RAM: What Changes for TEE-Based Blockchain Infrastructure (Webinar · 2025-11 · Blockchain) — https://trailofbits.com/library/after-wiretap-and-battering-ram-what-changes-for-tee-based-blockchain/
- Zama (Security review · 2025-10 · Crypto) — https://trailofbits.com/library/zama/
- X XChat (Security review · X · 2025-10 · AppSec) — https://trailofbits.com/library/x-xchat/
- Edera Runtime Container (Security review · Edera, Inc · 2025-10 · AppSec) — https://trailofbits.com/library/edera-runtime-container/
- VeChain VeChainThor Hayabusa Upgrade (Security review · VeChain · 2025-10 · Blockchain) — https://trailofbits.com/library/vechain-vechainthor-hayabusa-upgrade/
- Franklin Templeton BenjiSwap Contract (Security review · Franklin Templeton · 2025-10 · Blockchain) — https://trailofbits.com/library/franklin-templeton-benjiswap-contract/
- Radius Technology EVMAuth (Security review · Radius Technology · 2025-10 · Blockchain) — https://trailofbits.com/library/radius-technology-evmauth/
- Detecting Implicit Conversions in OpenVPN2 Using CodeQL (Whitepaper · 2025-09) — https://trailofbits.com/library/detecting-implicit-conversions-in-openvpn2-using-codeql/
- Risky Biz (Podcast · 2025-09) — https://trailofbits.com/library/risky-biz-2025/
- Zero Signal (Podcast · 2025-09) — https://trailofbits.com/library/zero-signal/
- DFINITY Orbit (Security review · DFINITY · 2025-09 · Crypto) — https://trailofbits.com/library/dfinity-orbit/
- DFINITY Oisy (Security review · DFINITY · 2025-09 · Crypto) — https://trailofbits.com/library/dfinity-oisy/
- Gensyn ERC-20 Token (Security review · Gensyn · 2025-09 · Blockchain) — https://trailofbits.com/library/gensyn-erc-20-token/
- Shape Buyback Contract (Security review · Shape Factory · 2025-09 · Blockchain) — https://trailofbits.com/library/shape-buyback-contract/
- Unsupervised Learning (Podcast · 2025-08) — https://trailofbits.com/library/unsupervised-learning/
- Security Weekly 342 (Podcast · 2025-08) — https://trailofbits.com/library/security-weekly-342/
- CTF Radiooo 01E (Podcast · 2025-08) — https://trailofbits.com/library/ctf-radiooo-01e/
- Google Longfellow (Security review · Google · 2025-08 · Crypto) — https://trailofbits.com/library/google-longfellow/
- Meta WhatsApp Private Processing (Security review · 2025-08 · AppSec) — https://trailofbits.com/library/meta-whatsapp-private-processing/
- Gemini Smart Wallet (Security review · Gemini · 2025-08 · Blockchain) — https://trailofbits.com/library/gemini-smart-wallet/
- Ava Labs AvalancheGo (Security review · Ava Labs · 2025-08 · Blockchain) — https://trailofbits.com/library/ava-labs-avalanchego/
- Starkware StarkEx Diff (Security review · StarkWare · 2025-08 · Blockchain) — https://trailofbits.com/library/starkware-starkex-diff/
- EVAA Finance (Security review · Something Labs LTD · 2025-08 · Blockchain) — https://trailofbits.com/library/evaa-finance/
- MCP Security Deep Dive: From Attacks to Defense (Webinar · 2025-07) — https://trailofbits.com/library/mcp-security-deep-dive-from-attacks-to-defense/
- Offchain Labs Upgrade Executor (Security review · Offchain Labs · 2025-07 · Blockchain) — https://trailofbits.com/library/offchain-labs-upgrade-executor/
- Scroll Feynman Upgrade Smart Contract Changes (Security review · Scroll · 2025-07 · Blockchain) — https://trailofbits.com/library/scroll-feynman-upgrade-smart-contract-changes/
- Swap Coffee TON DEX (Security review · Swap Coffee · 2025-07 · Blockchain) — https://trailofbits.com/library/swap-coffee-ton-dex/
- Click Here Show (Podcast · 2025-06) — https://trailofbits.com/library/click-here-show/
- Security Weekly 336 (Podcast · 2025-06) — https://trailofbits.com/library/security-weekly-336/
- Protect AI (Podcast · 2025-06) — https://trailofbits.com/library/protect-ai/
- Offchain SetCoreGovernorQuorumAction (Security review · Offchain Labs · 2025-06 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-setcoregovernorquorumaction/
- Offchain Arbitrum Mint/Burn Precompile (Security review · Offchain Labs · 2025-06 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-arbitrum-mint-burn-precompile/
- Offchain Arbitrum Block Hash Pusher (Security review · Offchain Labs · 2025-06 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-arbitrum-block-hash-pusher/
- Reserve Protocol Solidity 4.0.0 (Security review · Reserve Protocol · 2025-06 · Blockchain) — https://trailofbits.com/library/reserve-protocol-solidity-4-0-0/
- Discord E2EE WebAssembly (Security review · Discord · 2025-06 · AppSec) — https://trailofbits.com/library/discord-e2ee-webassembly/
- Open Source Security (Podcast · 2025-05) — https://trailofbits.com/library/open-source-security/
- Offchain ArbOS 40 Nitro (Security review · Offchain Labs · 2025-05 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-arbos-40-nitro/
- NEAR One PedPop+ (Security review · NEAR One · 2025-05 · Crypto) — https://trailofbits.com/library/near-one-pedpop/
- libVLC (Security review · OSTIF · 2025-05 · AppSec) — https://trailofbits.com/library/libvlc/
- Shape Token Contract (Security review · Shape Factory · 2025-05 · Blockchain) — https://trailofbits.com/library/shape-token-contract/
- CAP Labs Covered Agent Protocol (Security review · CAP Labs · 2025-05 · Blockchain) — https://trailofbits.com/library/cap-labs-covered-agent-protocol/
- Fabric Labs Zipper Protocol (Security review · Fabric Labs · 2025-05 · Blockchain) — https://trailofbits.com/library/fabric-labs-zipper-protocol/
- FIVA Yield Protocol (Security review · FIVA · 2025-05 · Blockchain) — https://trailofbits.com/library/fiva-yield-protocol/
- FIVA Evaa Integration (Security review · FIVA · 2025-05 · Blockchain) — https://trailofbits.com/library/fiva-evaa-integration/
- Whales Holders (Security review · Whales DMCC · 2025-05 · Blockchain) — https://trailofbits.com/library/whales-holders/
- Whales Nominators (Security review · Whales DMCC · 2025-05 · Blockchain) — https://trailofbits.com/library/whales-nominators/
- MLSecOps (Podcast · 2025-04) — https://trailofbits.com/library/mlsecops/
- Risky Biz 786 (Podcast · 2025-04) — https://trailofbits.com/library/risky-biz-786/
- Offchain Reward Distributor Fixes (Security review · Offchain Labs · 2025-04 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-reward-distributor-fixes/
- Reserve Protocol Solana DTFs (Security review · Reserve Protocol · 2025-04 · Blockchain) — https://trailofbits.com/library/reserve-protocol-solana-dtfs/
- Reserve Folio Solidity-Based Contracts (Security review · Reserve Protocol · 2025-04 · Blockchain) — https://trailofbits.com/library/reserve-protocol-reserve-folio-solidity-based-contracts/
- Scroll Euclid Phase 2 (Security review · Scroll · 2025-04 · Blockchain) — https://trailofbits.com/library/scroll-euclid-phase-2/
- Scroll Euclid Phase 1 (Security review · Scroll · 2025-04 · Blockchain) — https://trailofbits.com/library/scroll-euclid-phase-1/
- Open Quantum Safe liboqs (Security review · Open Quantum Safe · 2025-04 · Crypto) — https://trailofbits.com/library/open-quantum-safe-liboqs/
- Lagrange LAToken (Security review · Lagrange · 2025-04 · Blockchain) — https://trailofbits.com/library/lagrange-latoken/
- Serai DEX (Security review · Serai · 2025-04 · Blockchain) — https://trailofbits.com/library/serai-dex/
- Security Weekly 323 (Podcast · 2025-03) — https://trailofbits.com/library/security-weekly-323/
- Xyonix (Podcast · 2025-03) — https://trailofbits.com/library/xyonix/
- Security Audits: Best Practices with Trail of Bits (Webinar · 2025-03) — https://trailofbits.com/library/security-audits-best-practices-with-trail-of-bits/
- Offchain Sequencer Liveness (Security review · Offchain Labs · 2025-03 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-sequencer-liveness/
- Offchain Custom Fee Bridge & EIP-7702 (Security review · Offchain Labs · 2025-03 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-custom-fee-bridge-eip-7702/
- Offchain Geth 14.4 Pectra (Security review · Offchain Labs · 2025-03 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-geth-14-4-pectra/
- Offchain Custom Fee Exchange Rate (Security review · Offchain Labs · 2025-03 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-custom-fee-exchange-rate/
- Offchain Security Council Rotation (Security review · Offchain Labs · 2025-03 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-security-council-rotation/
- Offchain DisableGateway USDT (Security review · Offchain Labs · 2025-03 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-disablegateway-usdt/
- NEAR One MPC Chain Signatures (Security review · NEAR One · 2025-03 · Crypto) — https://trailofbits.com/library/near-one-mpc-chain-signatures/
- Go Crypto Libraries (Security review · Google · 2025-03 · Crypto) — https://trailofbits.com/library/go-crypto-libraries/
- Zkonduit EZKL (Security review · Zkonduit Inc · 2025-03 · Crypto) — https://trailofbits.com/library/zkonduit-ezkl/
- Otim Smart Wallet (Security review · Otim · 2025-03 · Blockchain) — https://trailofbits.com/library/otim-smart-wallet/
- Preventing Account Takeovers on Centralized Cryptocurrency Exchanges Recommended Practices (Whitepaper · 2025-02) — https://trailofbits.com/library/preventing-account-takeovers-on-centralized-cryptocurrency-exchanges-r/
- The Impulsive Thinker (Podcast · 2025-02) — https://trailofbits.com/library/the-impulsive-thinker/
- NATS Server (Security review · 2025-02 · AppSec) — https://trailofbits.com/library/nats-server/
- Automata (Security review · Automata Network · 2025-02 · Blockchain) — https://trailofbits.com/library/automata/
- Franklin Templeton Benji Contracts (Security review · Franklin Templeton · 2025-02 · Blockchain) — https://trailofbits.com/library/franklin-templeton-benji-contracts/
- zkVerify (Security review · zkVerify Foundation · 2025-02 · Blockchain) — https://trailofbits.com/library/zkverify/
- Buttercup: Autonomously Finding and Fixing Bugs at Scale in Open-Source Software (Conference talk · 2025 · Systems) — https://trailofbits.com/library/buttercup-autonomously-finding-and-fixing-bugs-at-scale-in-open-source/
- Buttercup: The Future of Trail of Bits' Solution to DARPA's AI Cyber Challenge (Conference talk · 2025 · Systems) — https://trailofbits.com/library/buttercup-the-future-of-trail-of-bits-solution-to-darpa-s-ai-cyber-cha/
- Buttercup and DARPA's AI Cyber Challenge, Ringzer0 (Conference talk · 2025 · Systems) — https://trailofbits.com/library/buttercup-and-darpa-s-ai-cyber-challenge-ringzer0/
- Our experience competing in the AI Cyber Challenge (Conference talk · 2025 · Systems) — https://trailofbits.com/library/our-experience-competing-in-the-ai-cyber-challenge/
- Mutation Testing with Slither: A New Way to Find High-Severity Issues (Conference talk · 2025 · Blockchain) — https://trailofbits.com/library/mutation-testing-with-slither-a-new-way-to-find-high-severity-issues/
- Slither's Model Context Protocol: Giving LLMs Ground Truth from Static Analysis (Conference talk · 2025 · Blockchain) — https://trailofbits.com/library/slither-s-model-context-protocol-giving-llms-ground-truth-from-static/
- The $1.5B Problem: How Exchanges Can Build Safer Cold Storage (Conference talk · 2025 · Blockchain) — https://trailofbits.com/library/the-1-5b-problem-how-exchanges-can-build-safer-cold-storage/
- How to Become a Smart Contract Auditor (Conference talk · 2025 · Blockchain) — https://trailofbits.com/library/how-to-become-a-smart-contract-auditor/
- Constant-Time Coding Support in LLVM (Conference talk · 2025 · Systems) — https://trailofbits.com/library/constant-time-coding-support-in-llvm/
- Cut To The QUIC: Slashing QUIC's Performance With A Hash DoS (Conference talk · 2025 · Crypto) — https://trailofbits.com/library/cut-to-the-quic-slashing-quic-s-performance-with-a-hash-dos/
- One, Two, TEE: Trust in Numbers Meets Hardware Security (Conference talk · 2025 · Crypto) — https://trailofbits.com/library/one-two-tee-trust-in-numbers-meets-hardware-security/
- Repeatable Benchmarking: An Exploration of OpenSearch vs Elasticsearch (Conference talk · 2025 · Systems) — https://trailofbits.com/library/repeatable-benchmarking-an-exploration-of-opensearch-vs-elasticsearch/
- Weaponizing Image Scaling Against Production AI Systems (Conference talk · 2025 · AI/ML) — https://trailofbits.com/library/weaponizing-image-scaling-against-production-ai-systems/
- Indirect Prompt Injection: Architectural Testing Approaches for Real World AI/ML Systems (Conference talk · 2025 · AI/ML) — https://trailofbits.com/library/indirect-prompt-injection-architectural-testing-approaches-for-real-wo/
- From Polyglots to Prompt Injections: Parsing is Still Execution (And Your LLM Didn't Get the Memo) (Conference talk · 2025 · AI/ML) — https://trailofbits.com/library/from-polyglots-to-prompt-injections-parsing-is-still-execution-and-you/
- Frontier AI in Cybersecurity: Risks and Opportunities (Conference talk · 2025 · AI/ML) — https://trailofbits.com/library/frontier-ai-in-cybersecurity-risks-and-opportunities/
- macOS Privilege Escalation Via Traceroute6 (Conference talk · 2025 · AppSec) — https://trailofbits.com/library/macos-privilege-escalation-via-traceroute6/
- Attestations: a new generation of signatures on PyPI (Conference talk · 2025 · Supply Chain) — https://trailofbits.com/library/attestations-a-new-generation-of-signatures-on-pypi/
- ZetaChain Bitcoin Inscriptions (Security review · ZetaChain · 2025-01 · Blockchain) — https://trailofbits.com/library/zetachain-bitcoin-inscriptions/
- Bunni v2 (Security review · Bacon Labs · 2025-01 · Blockchain) — https://trailofbits.com/library/bunni-v2/
- Everstake Staking (Security review · Everstake · 2025-01 · Blockchain) — https://trailofbits.com/library/everstake-staking/
- Parabol Smart Contracts Updates (Security review · Parabol Labs · 2025-01 · Blockchain) — https://trailofbits.com/library/parabol-smart-contracts-updates/
- BeethovenX Sonic Staking (Security review · Beethoven X · 2025-01 · Blockchain) — https://trailofbits.com/library/beethovenx-sonic-staking/
- ZetaChain Solana Gateway (Security review · ZetaChain · 2025-01 · Blockchain) — https://trailofbits.com/library/zetachain-solana-gateway/
- STON.fi DEX V2 (Security review · STON.fi Holding Ltd · 2025-01 · Blockchain) — https://trailofbits.com/library/ston-fi-dex-v2/
- Tact Compiler (Security review · TON Studio · 2025-01 · Blockchain) — https://trailofbits.com/library/tact-compiler/
- Shape Gasback (Security review · Shape · 2025-01 · Blockchain) — https://trailofbits.com/library/shape-gasback/
- Denial of Service in protobuf-python (Disclosure · protobuf-python · 2025) — https://trailofbits.com/library/denial-of-service-in-protobuf-python/
- Vulnerabilities in LUKS2 disk encryption for confidential VMs (Disclosure · Linux LUKS2 · 2025) — https://trailofbits.com/library/linux-luks2-vulnerabilities-in-luks2-disk-encryption-for-confidential/
- Prompt injection to RCE in AI agents (Disclosure · Multiple · 2025) — https://trailofbits.com/library/ai-agents-multiple-platforms-prompt-injection-to-rce-in-ai-agents/
- Code integrity bypass in Electron applications (Disclosure · Multiple · 2025) — https://trailofbits.com/library/electron-applications-signal-1password-slack-code-integrity-bypass-in/
- Weaponizing image scaling against production AI systems (Disclosure · Multiple · 2025) — https://trailofbits.com/library/google-gemini-vertex-ai-genspark-weaponizing-image-scaling-against-pro/
- Prompt injection engineering for attackers: Exploiting GitHub Copilot (Disclosure · GitHub Copilot Agent · 2025) — https://trailofbits.com/library/github-copilot-agent-prompt-injection-engineering-for-attackers-exploi/
- Memory corruption in NVIDIA Triton Inference Server (Disclosure · NVIDIA Triton · 2025 · AI/ML) — https://trailofbits.com/library/memory-corruption-in-nvidia-triton-inference-server/
- Exploiting zero days in abandoned hardware (Disclosure · Multiple · 2025) — https://trailofbits.com/library/netgear-wgr614v9-bitdefender-box-v1-exploiting-zero-days-in-abandoned/
- MCP plaintext API key storage (Disclosure · Model Context Protocol · 2025) — https://trailofbits.com/library/model-context-protocol-mcp-plaintext-api-key-storage/
- MCP ANSI escape sequence attacks (Disclosure · Model Context Protocol · 2025) — https://trailofbits.com/library/model-context-protocol-mcp-ansi-escape-sequence-attacks/
- MCP Line Jumping vulnerability (Disclosure · Model Context Protocol · 2025) — https://trailofbits.com/library/model-context-protocol-mcp-line-jumping-vulnerability/
- User to root privilege escalation from an integer overflow in libinfo (Disclosure · macOS · 2025) — https://trailofbits.com/library/macos-user-to-root-privilege-escalation-from-an-integer-overflow-in-li/
- Input-Driven Recursion: Ongoing Security Risks (Whitepaper · 2024-12) — https://trailofbits.com/library/input-driven-recursion-ongoing-security-risks/
- Offchain BoLD Fixes (Security review · Offchain Labs · 2024-12 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-bold-fixes/
- Scopely Monopoly Go! (Security review · Scopely, Inc · 2024-12 · Crypto) — https://trailofbits.com/library/scopely-monopoly-go/
- Aligned (Security review · Aligned Layer · 2024-12 · Crypto) — https://trailofbits.com/library/aligned/
- Istio Ztunnel (Security review · 2024-12 · AppSec) — https://trailofbits.com/library/istio-ztunnel/
- RubyGems.org (Security review · Ruby Central · 2024-12 · AppSec) — https://trailofbits.com/library/rubygems-org/
- Balancer v3 (Security review · Balancer · 2024-12 · Blockchain) — https://trailofbits.com/library/balancer-v3/
- ULTI (Security review · ULTI · 2024-12 · Blockchain) — https://trailofbits.com/library/ulti/
- EthStaker Deposit CLI (Security review · EthStaker · 2024-12 · Blockchain) — https://trailofbits.com/library/ethstaker-deposit-cli-2024/
- PixelSwap DEX (Security review · PixelSwap Labs Ltd · 2024-12 · Blockchain) — https://trailofbits.com/library/pixelswap-dex/
- Arkis Prime (Security review · Arkis · 2024-12 · Blockchain) — https://trailofbits.com/library/arkis-prime/
- Kraken Wallet In-App Browser (Security review · Kraken · 2024-11 · AppSec) — https://trailofbits.com/library/kraken-wallet-in-app-browser/
- Nomic (Security review · Nomic DAO Foundation · 2024-11 · Blockchain) — https://trailofbits.com/library/nomic/
- Plume (Security review · Plume · 2024-11 · Blockchain) — https://trailofbits.com/library/plume/
- Orga and Merk (Security review · Turbofish · 2024-11 · Blockchain) — https://trailofbits.com/library/orga-and-merk/
- Bugcrowd (Podcast · 2024-10) — https://trailofbits.com/library/bugcrowd/
- Risky Biz (Podcast · 2024-10) — https://trailofbits.com/library/risky-biz-2024/
- Offchain Stylus Emergency Fixes (Security review · Offchain Labs · 2024-10 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-stylus-emergency-fixes/
- Offchain BoLD History Commits (Security review · Offchain Labs · 2024-10 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-bold-history-commits/
- Offchain Nitro with BoLD (Security review · Offchain Labs · 2024-10 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-nitro-with-bold/
- Franklin Templeton Aptos (Security review · Franklin Templeton · 2024-10 · Blockchain) — https://trailofbits.com/library/franklin-templeton-aptos/
- Offchain Stylus (Security review · Offchain Labs · 2024-09 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-stylus/
- Discord DAVE (Security review · Discord · 2024-09 · Crypto) — https://trailofbits.com/library/discord-dave/
- Kraken Wallet iCloud Backup (Security review · Kraken · 2024-09 · AppSec) — https://trailofbits.com/library/kraken-wallet-icloud-backup/
- Treehouse tETH Protocol (Security review · Treehouse · 2024-09 · Blockchain) — https://trailofbits.com/library/treehouse-teth-protocol/
- OpenSearch Benchmark Assessment (Whitepaper · 2024-08) — https://trailofbits.com/library/opensearch-benchmark-assessment/
- Cedar, Rego, and OpenFGA Policy Languages: Comparative Language Security Assessment (Whitepaper · 2024-08) — https://trailofbits.com/library/cedar-rego-and-openfga-policy-languages-comparative-language-security/
- Risky Biz 759 (Podcast · 2024-08) — https://trailofbits.com/library/risky-biz-759/
- Offchain RARI (Security review · Offchain Labs · 2024-08 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-rari/
- Offchain Office Hours Action (Security review · Offchain Labs · 2024-08 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-office-hours-action/
- Offchain Timeboost Auction (Security review · Offchain Labs · 2024-08 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-timeboost-auction/
- Offchain Orbit Actions (Security review · Offchain Labs · 2024-08 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-orbit-actions/
- Discord DAVE (Security review · Discord · 2024-08 · Crypto) — https://trailofbits.com/library/discord-dave-2024/
- Elixir Protocol (Security review · Elixir Technologies Ltd · 2024-08 · Blockchain) — https://trailofbits.com/library/elixir-protocol/
- Onchain Pass (Security review · Pass App Ltd · 2024-08 · Blockchain) — https://trailofbits.com/library/onchain-pass/
- Offchain USDC Gateway (Security review · Offchain Labs · 2024-07 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-usdc-gateway/
- Uniswap v4 Core (Security review · Uniswap · 2024-07 · Blockchain) — https://trailofbits.com/library/uniswap-v4-core/
- Hugging Face Gradio (Security review · Hugging Face · 2024-07 · AppSec) — https://trailofbits.com/library/hugging-face-gradio/
- Taraxa Ficus Bridge (Security review · Taraxa · 2024-07 · Blockchain) — https://trailofbits.com/library/taraxa-ficus-bridge/
- Mastering Web Research with Burp Suite (Webinar · 2024-06) — https://trailofbits.com/library/mastering-web-research-with-burp-suite/
- Offchain BoLD & DAC Rewards (Security review · Offchain Labs · 2024-06 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-bold-dac-rewards/
- Scroll zstd Compression (Security review · Scroll · 2024-06 · Blockchain) — https://trailofbits.com/library/scroll-zstd-compression/
- Lit Protocol Cait-Sith (Security review · Lit Protocol · 2024-06 · Crypto) — https://trailofbits.com/library/lit-protocol-cait-sith/
- Zoo KittyCAD (Security review · Zoo · 2024-06 · AppSec) — https://trailofbits.com/library/zoo-kittycad/
- Devcon Auction Raffle (Security review · Ethereum Foundation · 2024-06 · Blockchain) — https://trailofbits.com/library/devcon-auction-raffle/
- Aladdin f(x) Oracle (Security review · AladdinDAO · 2024-06 · Blockchain) — https://trailofbits.com/library/aladdin-f-x-oracle/
- Resilience Rundown (Podcast · 2024-05) — https://trailofbits.com/library/resilience-rundown/
- Offchain Arbitrum Stylus (Security review · Offchain Labs · 2024-05 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-arbitrum-stylus/
- Polygon Labs Iden3 Circuits (Security review · Polygon Labs · 2024-05 · AppSec) — https://trailofbits.com/library/polygon-labs-iden3-circuits/
- Panoptic (Security review · Panoptic · 2024-05 · Blockchain) — https://trailofbits.com/library/panoptic/
- AiLayer 6079 Contracts (Security review · AiLayer Labs · 2024-05 · Blockchain) — https://trailofbits.com/library/ailayer-6079-contracts/
- Hydrogen Rover Protocol (Security review · Hydrogen Labs · 2024-05 · Blockchain) — https://trailofbits.com/library/hydrogen-rover-protocol/
- Lisk Smart Contracts (Security review · Lisk · 2024-05 · Blockchain) — https://trailofbits.com/library/lisk-smart-contracts/
- Parabol Smart Contracts (Security review · Parabol Labs · 2024-05 · Blockchain) — https://trailofbits.com/library/parabol-smart-contracts/
- Wonderland Prophet (Security review · Wonderland · 2024-05 · Blockchain) — https://trailofbits.com/library/wonderland-prophet/
- Risky Biz (Podcast · 2024-04) — https://trailofbits.com/library/risky-biz-2/
- Offchain L1-L3 Teleporter (Security review · Offchain Labs · 2024-04 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-l1-l3-teleporter/
- Offchain ArbOS 31 (Security review · Offchain Labs · 2024-04 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-arbos-31/
- Offchain ArbOS 30 Nitro (Security review · Offchain Labs · 2024-04 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-arbos-30-nitro/
- Offchain BoLD (Security review · Offchain Labs · 2024-04 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-bold/
- Scroll ZkEVM 4844 Blob (Security review · Scroll · 2024-04 · Blockchain) — https://trailofbits.com/library/scroll-zkevm-4844-blob/
- Iron Fish FishHash (Security review · Iron Fish · 2024-04 · Crypto) — https://trailofbits.com/library/iron-fish-fishhash/
- MLSecOps March 20 (Podcast · 2024-03) — https://trailofbits.com/library/mlsecops-march-20/
- Introduction to CodeQL: Examples, Tools and CI Integration (Webinar · 2024-03) — https://trailofbits.com/library/introduction-to-codeql-examples-tools-and-ci-integration/
- Curvance (Security review · Curvance · 2024-03 · Blockchain) — https://trailofbits.com/library/curvance/
- SEDA Chain Token Migration (Security review · SEDA · 2024-03 · Blockchain) — https://trailofbits.com/library/seda-chain-token-migration/
- Lisk Smart Contracts (Security review · Lisk · 2024-03 · Blockchain) — https://trailofbits.com/library/lisk-smart-contracts-2024/
- Bondex Smart Contracts (Security review · Ethereum/EVM · 2024-03 · Blockchain) — https://trailofbits.com/library/bondex-smart-contracts/
- Aladdin f(x) Protocol (Security review · AladdinDAO · 2024-03 · Blockchain) — https://trailofbits.com/library/aladdin-f-x-protocol/
- Puffer Finance Contracts (Security review · Puffer Finance · 2024-03 · Blockchain) — https://trailofbits.com/library/puffer-finance-contracts/
- Intuition (Security review · Intuition · 2024-03 · Blockchain) — https://trailofbits.com/library/intuition/
- TON Foundation Multisignature Wallet (Security review · TON Foundation · 2024-03 · Blockchain) — https://trailofbits.com/library/ton-foundation-multisignature-wallet/
- Offchain ArbOS (Security review · Offchain Labs · 2024-02 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-arbos/
- Uniswap Browser Extension (Security review · Uniswap · 2024-02 · Blockchain) — https://trailofbits.com/library/uniswap-browser-extension/
- Silence Laboratories Silent Shard (Security review · Silence Laboratories · 2024-02 · Crypto) — https://trailofbits.com/library/silence-laboratories-silent-shard/
- Helios Global (Security review · Helios Global · 2024-02 · Blockchain) — https://trailofbits.com/library/helios-global/
- ScopeLift Stealth Addresses (Security review · ScopeLift · 2024-02 · Blockchain) — https://trailofbits.com/library/scopelift-stealth-addresses/
- A Broad Comparative Evaluation of Software Debloating Tools (Academic paper · 2024) — https://trailofbits.com/library/a-broad-comparative-evaluation-of-software-debloating-tools/
- PolyTracker: Whole-Input Dynamic Information Flow Tracing (Academic paper · 2024 · Systems) — https://trailofbits.com/library/polytracker-whole-input-dynamic-information-flow-tracing/
- Endokernel: A Thread Safe Monitor for Lightweight Subprocess Isolation (Academic paper · 2024 · Systems) — https://trailofbits.com/library/endokernel-a-thread-safe-monitor-for-lightweight-subprocess-isolation/
- Design and Implementation of a Coverage-Guided Ruby Fuzzer (Academic paper · 2024) — https://trailofbits.com/library/design-and-implementation-of-a-coverage-guided-ruby-fuzzer/
- Test Harness Mutilation (Academic paper · 2024) — https://trailofbits.com/library/test-harness-mutilation/
- VAST: MLIR compiler for C/C++ (Academic paper · 2024) — https://trailofbits.com/library/vast-mlir-compiler-for-c-c/
- PoTATo: Points-to analysis via domain specific MLIR dialect (Academic paper · 2024) — https://trailofbits.com/library/potato-points-to-analysis-via-domain-specific-mlir-dialect/
- Buttercup and DARPA's AI Cyber Challenge, CSAW (Conference talk · 2024 · Systems) — https://trailofbits.com/library/buttercup-and-darpa-s-ai-cyber-challenge-csaw/
- A Broad Comparative Evaluation of Software Debloating Tools (Conference talk · 2024 · Systems) — https://trailofbits.com/library/a-broad-comparative-evaluation-of-software-debloating-tools-2024/
- Repurposing LLVM analyses in MLIR: Also there and back again across the tower of IRs (Conference talk · 2024 · Systems) — https://trailofbits.com/library/repurposing-llvm-analyses-in-mlir-also-there-and-back-again-across-the/
- Weak Fiat-Shamir attacks on modern proof systems (Conference talk · 2024 · Crypto) — https://trailofbits.com/library/weak-fiat-shamir-attacks-on-modern-proof-systems/
- Building a Rusty path validation library for PyCA Cryptography (Conference talk · 2024 · Crypto) — https://trailofbits.com/library/building-a-rusty-path-validation-library-for-pyca-cryptography/
- Implementing X.509 path validation for Python (Conference talk · 2024 · Crypto) — https://trailofbits.com/library/implementing-x-509-path-validation-for-python/
- Introduction to Semgrep (Conference talk · 2024 · Systems) — https://trailofbits.com/library/introduction-to-semgrep/
- The Present and Future of AI and Security (Conference talk · 2024 · AI/ML) — https://trailofbits.com/library/the-present-and-future-of-ai-and-security/
- Incubated Machine Learning Exploits: Backdooring ML Pipelines Using Input-Handling Bugs (Conference talk · 2024 · AI/ML) — https://trailofbits.com/library/incubated-machine-learning-exploits-backdooring-ml-pipelines-using-inp/
- Holistic ML Threat Models (Conference talk · 2024 · AI/ML) — https://trailofbits.com/library/holistic-ml-threat-models/
- The Next 5 Years of Supply Chain Security on PyPI (Conference talk · 2024 · Supply Chain) — https://trailofbits.com/library/the-next-5-years-of-supply-chain-security-on-pypi/
- PEP 740 and PyPI: Bootstrapping Provenance for the Python Ecosystem (Conference talk · 2024 · Supply Chain) — https://trailofbits.com/library/pep-740-and-pypi-bootstrapping-provenance-for-the-python-ecosystem/
- Imagining a zero-trust future for PyPI (Conference talk · 2024 · Supply Chain) — https://trailofbits.com/library/imagining-a-zero-trust-future-for-pypi/
- Build Provenance: Lessons (so far) from Homebrew (Conference talk · 2024 · Supply Chain) — https://trailofbits.com/library/build-provenance-lessons-so-far-from-homebrew/
- Introduction to Semgrep (Webinar · 2024-01) — https://trailofbits.com/library/introduction-to-semgrep-2024/
- Offchain Arbitrum (Security review · Offchain Labs · 2024-01 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-arbitrum/
- Snow (Security review · AgileBits · 2024-01 · Crypto) — https://trailofbits.com/library/snow/
- Kraken Mobile Wallet (Security review · Kraken · 2024-01 · AppSec) — https://trailofbits.com/library/kraken-mobile-wallet/
- MetaLayer Blast (Security review · MetaLayer Labs · 2024-01 · Blockchain) — https://trailofbits.com/library/metalayer-blast/
- Cryptography bugs in elliptic library (Disclosure · elliptic JavaScript library · 2024) — https://trailofbits.com/library/elliptic-javascript-library-cryptography-bugs-in-elliptic-library/
- Crash due to uncontrolled recursion in Well-KnownText (Disclosure · Elastic · 2024) — https://trailofbits.com/library/elastic-crash-due-to-uncontrolled-recursion-in-well-knowntext/
- Crash due to uncontrolled recursion in innerForbidCircularReferences (Disclosure · Elastic · 2024) — https://trailofbits.com/library/elastic-crash-due-to-uncontrolled-recursion-in-innerforbidcircularrefe/
- Crash due to uncontrolled recursion in Wire (Disclosure · Wire · 2024) — https://trailofbits.com/library/crash-due-to-uncontrolled-recursion-in-wire/
- Crash due to uncontrolled recursion in protobuf crate (Disclosure · rust-protobuf · 2024) — https://trailofbits.com/library/rust-protobuf-crash-due-to-uncontrolled-recursion-in-protobuf-crate/
- Denial of Service in XStream (Disclosure · XStream · 2024) — https://trailofbits.com/library/denial-of-service-in-xstream/
- Denial of Service in protobuf-java (Disclosure · protobuf-java · 2024) — https://trailofbits.com/library/denial-of-service-in-protobuf-java/
- Insufficient validation of integration timestamp in sigstore-python (Disclosure · sigstore-python · 2024 · Supply Chain) — https://trailofbits.com/library/insufficient-validation-of-integration-timestamp-in-sigstore-python/
- Rust crates "stable" and "nightly" might be installed instead of the corresponding toolchains (Disclosure · Crates.io · 2024) — https://trailofbits.com/library/crates-io-rust-crates-stable-and-nightly-might-be-installed-instead-of/
- num-bigint disclosure (Disclosure · num-bigint · 2024) — https://trailofbits.com/library/num-bigint-disclosure/
- Memory corruption during X.509 validation in GnuTLS (Disclosure · GnuTLS · 2024) — https://trailofbits.com/library/memory-corruption-during-x-509-validation-in-gnutls/
- Linux kernel modules kASLR bypass (Disclosure · Linux · 2024 · Systems) — https://trailofbits.com/library/linux-kernel-modules-kaslr-bypass/
- Pedersen DKG vulnerability disclosure (Disclosure · Multiple · 2024) — https://trailofbits.com/library/multiple-pedersen-dkg-vulnerability-disclosure/
- LeftoverLocals disclosure (Disclosure · Multiple · 2024) — https://trailofbits.com/library/multiple-gpus-leftoverlocals-disclosure/
- yWhales (Podcast · 2023-12) — https://trailofbits.com/library/ywhales/
- Automated Artifical Intelligence Bill Of Materials for AI/ML Ops (Policy comment · U.S. Army PEO IEW&S · 2023-12) — https://trailofbits.com/library/u-s-army-peo-iew-s-automated-artifical-intelligence-bill-of-materials/
- Offchain Token Bridge Creator (Security review · Offchain Labs · 2023-12 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-token-bridge-creator/
- Eclipse Temurin (Security review · OSTIF · 2023-12 · AppSec) — https://trailofbits.com/library/eclipse-temurin/
- Arch Linux Pacman (Security review · Open Technology Fund · 2023-12 · AppSec) — https://trailofbits.com/library/arch-linux-pacman/
- cURL HTTP3 (Security review · Open Source Technology Improvement Fund · 2023-12 · AppSec) — https://trailofbits.com/library/curl-http3/
- Unibot Router (Security review · Unibot · 2023-12 · Blockchain) — https://trailofbits.com/library/unibot-router/
- Acronym Foundation (Security review · Acronym Foundation · 2023-12 · Blockchain) — https://trailofbits.com/library/acronym-foundation/
- Pyth Entropy (Security review · Pyth Data Association · 2023-12 · Blockchain) — https://trailofbits.com/library/pyth-entropy/
- Opus (Security review · Lindy Labs · 2023-12 · Blockchain) — https://trailofbits.com/library/opus/
- Open-Source Software Security: Areas of Long-Term Focus and Prioritization (Policy comment · ONCD, CISA, NSF, DARPA, OMB · 2023-11) — https://trailofbits.com/library/oncd-cisa-nsf-darpa-omb-open-source-software-security-areas-of-long-te/
- Ockam (Security review · Ockam · 2023-11 · Crypto) — https://trailofbits.com/library/ockam/
- Dfinity Candid (Security review · DFINITY · 2023-11 · Crypto) — https://trailofbits.com/library/dfinity-candid/
- Immutable Bridge (Security review · Immutable Games · 2023-11 · Blockchain) — https://trailofbits.com/library/immutable-bridge/
- Solang Code Generation (Security review · Solana · 2023-11 · Blockchain) — https://trailofbits.com/library/solang-code-generation/
- Solang Code Generation, Part 1 (Security review · Solana · 2023-11 · Blockchain) — https://trailofbits.com/library/solang-code-generation-part-1/
- YOLOv7 (Security review · 2023-10 · AI/ML) — https://trailofbits.com/library/yolov7/
- Axiom Halo2 Library Upgrades (Security review · Axiom · 2023-10 · Crypto) — https://trailofbits.com/library/axiom-halo2-library-upgrades/
- Aleo snarkVM, snarkOS, BullsharkBFT (Security review · Aleo Systems · 2023-10 · Crypto) — https://trailofbits.com/library/aleo-snarkvm-snarkos-bullsharkbft/
- Salty.IO Protocol (Security review · Salty.IO · 2023-10 · Blockchain) — https://trailofbits.com/library/salty-io-protocol/
- Spiko Smart Contracts (Security review · Spiko · 2023-10 · Blockchain) — https://trailofbits.com/library/spiko-smart-contracts/
- Squads V4 (Security review · Squads Protocol · 2023-10 · Blockchain) — https://trailofbits.com/library/squads-v4/
- Offchain Custom Fee Token (Security review · Offchain Labs · 2023-09 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-custom-fee-token/
- Scroll ZkEVM Wave 3 (Security review · Scroll · 2023-09 · Blockchain) — https://trailofbits.com/library/scroll-zkevm-wave-3/
- Uniswap (Security review · Uniswap · 2023-09 · Blockchain) — https://trailofbits.com/library/uniswap/
- Lisk SDK 6.1 modules (Security review · Lisk · 2023-09 · AppSec) — https://trailofbits.com/library/lisk-sdk-6-1-modules/
- OpenSSL (Security review · OSTIF · 2023-09 · AppSec) — https://trailofbits.com/library/openssl/
- PyPI Warehouse (Security review · Open Technology Fund · 2023-09 · Supply Chain) — https://trailofbits.com/library/pypi-warehouse-2023/
- wasmCloud (Security review · Open Source Technology Improvement Fund · 2023-09 · AppSec) — https://trailofbits.com/library/wasmcloud/
- Hyperlane v3 (Security review · Abacus Works · 2023-09 · Blockchain) — https://trailofbits.com/library/hyperlane-v3/
- Elixir Contracts (Security review · Elixir Protocol · 2023-09 · Blockchain) — https://trailofbits.com/library/elixir-contracts/
- Solang Parser and Semantic Analysis (Security review · Solana · 2023-09 · Blockchain) — https://trailofbits.com/library/solang-parser-and-semantic-analysis/
- Offchain Arbitrum Challenge v2 (Security review · Offchain Labs · 2023-08 · Blockchain) — https://trailofbits.com/library/offchain-labs-offchain-arbitrum-challenge-v2/
- Scroll l2geth (diff) (Security review · Scroll · 2023-08 · Blockchain) — https://trailofbits.com/library/scroll-l2geth-diff/
- Scroll l2geth (initial) (Security review · Scroll · 2023-08 · Blockchain) — https://trailofbits.com/library/scroll-l2geth-initial/
- Scroll ZkEVM Wave 2 (Security review · Scroll · 2023-08 · Blockchain) — https://trailofbits.com/library/scroll-zkevm-wave-2/
- Worldcoin (Security review · Worldcoin · 2023-08 · AppSec) — https://trailofbits.com/library/worldcoin/
- Homebrew (Security review · OTF · 2023-08 · AppSec) — https://trailofbits.com/library/homebrew/
- DigitalOcean OIDC (Security review · workflows. DigitalOcean then · 2023-08 · AppSec) — https://trailofbits.com/library/digitalocean-oidc/
- Flux (Security review · OSTIF · 2023-08 · AppSec) — https://trailofbits.com/library/flux/
- NZDD token (Security review · Easy Crypto · 2023-08 · Blockchain) — https://trailofbits.com/library/nzdd-token/
- Immutable (Security review · Immutable · 2023-08 · Blockchain) — https://trailofbits.com/library/immutable/
- Aura (Security review · Lindy Labs · 2023-08 · Blockchain) — https://trailofbits.com/library/aura/
- Berachain polaris-geth (Security review · 2023-08 · Blockchain) — https://trailofbits.com/library/berachain-polaris-geth/
- Understanding the National Security Implications of AI (Policy comment · Whitehouse OTSP · 2023-07) — https://trailofbits.com/library/whitehouse-otsp-understanding-the-national-security-implications-of-ai/
- Scroll zkTrie (Security review · Scroll · 2023-07 · Blockchain) — https://trailofbits.com/library/scroll-zktrie/
- Lisk SDK (Security review · Lisk · 2023-07 · AppSec) — https://trailofbits.com/library/lisk-sdk/
- DragonFly2 (Security review · OSTIF · 2023-07 · AppSec) — https://trailofbits.com/library/dragonfly2/
- dappOS v2 wallet (Security review · dappOS · 2023-07 · Blockchain) — https://trailofbits.com/library/dappos-v2-wallet/
- Sandclock (Security review · Lindy Labs · 2023-07 · Blockchain) — https://trailofbits.com/library/sandclock/
- Arcade (Security review · Arcade · 2023-07 · Blockchain) — https://trailofbits.com/library/arcade/
- Solang Solana Library (Security review · Solana · 2023-07 · Blockchain) — https://trailofbits.com/library/solang-solana-library/
- AI Accountability, Regulation, and Audits (Policy comment · NTIA · 2023-06) — https://trailofbits.com/library/ntia-ai-accountability-regulation-and-audits/
- A Comprehensive Risk Assessment Framework for AI Assurance in Ethical, Legal, and Societal Domains (Policy comment · DARPA · 2023-06) — https://trailofbits.com/library/darpa-a-comprehensive-risk-assessment-framework-for-ai-assurance-in-et/
- Axiom Halo2 Libraries (Security review · Axiom · 2023-06 · Crypto) — https://trailofbits.com/library/axiom-halo2-libraries/
- Dfinity ckBTC and BTC Integration (Security review · 2023-06 · Crypto) — https://trailofbits.com/library/dfinity-ckbtc-and-btc-integration/
- Dfinity SNS Phase 2 (Security review · DFINITY · 2023-06 · Crypto) — https://trailofbits.com/library/dfinity-sns-phase-2/
- Thesis tss-lib BitForge (Security review · Thesis · 2023-06 · Crypto) — https://trailofbits.com/library/thesis-tss-lib-bitforge/
- Nested Tetris/HyVM (Security review · Nested Finance · 2023-06 · Blockchain) — https://trailofbits.com/library/nested-tetris-hyvm/
- Berachain berachain (Security review · 2023-06 · Blockchain) — https://trailofbits.com/library/berachain-berachain/
- Risky Biz 707 (Podcast · 2023-05) — https://trailofbits.com/library/risky-biz-707/
- FraxGov (Security review · Frax Finance · 2023-05 · Blockchain) — https://trailofbits.com/library/frax-finance-fraxgov/
- Eclipse JKube (Security review · Open Source Technology Improvement Fund · 2023-05 · AppSec) — https://trailofbits.com/library/eclipse-jkube/
- Franklin Templeton (Security review · Franklin Templeton · 2023-05 · Blockchain) — https://trailofbits.com/library/franklin-templeton/
- Scroll ZkEVM Wave 1 (Security review · Scroll · 2023-04 · Blockchain) — https://trailofbits.com/library/scroll-zkevm-wave-1/
- Chainflip (Security review · Chainflip · 2023-04 · Crypto) — https://trailofbits.com/library/chainflip/
- Chainflip (Security review · Chainflip · 2023-04 · AppSec) — https://trailofbits.com/library/chainflip-2023/
- Prysm (Security review · A private client · 2023-04 · Blockchain) — https://trailofbits.com/library/prysm/
- Ajna Protocol (Security review · Ajna Labs · 2023-04 · Blockchain) — https://trailofbits.com/library/ajna-protocol/
- Raft (Security review · Tempus · 2023-04 · Blockchain) — https://trailofbits.com/library/raft/
- MYSO v2 (Security review · MYSO Finance · 2023-04 · Blockchain) — https://trailofbits.com/library/myso-v2/
- Smardex AMM (Security review · Real Estate Executive SA · 2023-04 · Blockchain) — https://trailofbits.com/library/smardex-amm/
- Toward Comprehensive Risk Assessments and Assurance of AI-Based Systems (Whitepaper · 2023-03) — https://trailofbits.com/library/toward-comprehensive-risk-assessments-and-assurance-of-ai-based-system/
- Understanding Crypto Markets Security (Policy comment · CFTC · 2023-03) — https://trailofbits.com/library/cftc-understanding-crypto-markets-security/
- SafeTensors (Security review · EleutherAI · 2023-03 · AI/ML) — https://trailofbits.com/library/safetensors/
- Eclipse Mosquitto (Security review · 2023-03 · AppSec) — https://trailofbits.com/library/eclipse-mosquitto/
- Eclipse Jetty (Security review · OSTIF · 2023-03 · AppSec) — https://trailofbits.com/library/eclipse-jetty/
- Spool Platform (Security review · Spool DAO · 2023-03 · AppSec) — https://trailofbits.com/library/spool-platform/
- WalletConnect v2.0 (Security review · WalletConnect · 2023-03 · Blockchain) — https://trailofbits.com/library/walletconnect-v2-0/
- Waymont (Security review · 2023-03 · Blockchain) — https://trailofbits.com/library/waymont/
- Atlendis (Security review · Atlendis Labs · 2023-03 · Blockchain) — https://trailofbits.com/library/atlendis/
- Primitive Hyper (Security review · Primitive · 2023-03 · Blockchain) — https://trailofbits.com/library/primitive-hyper/
- Wormhole Governors and Watchers (Security review · Wormhole Foundation · 2023-03 · Blockchain) — https://trailofbits.com/library/wormhole-governors-and-watchers/
- ASW 229 (Podcast · 2023-02) — https://trailofbits.com/library/asw-229/
- Stealth Addresses (Security review · Citizen Technologies · 2023-02 · Crypto) — https://trailofbits.com/library/stealth-addresses/
- Succinct ZK Light Client (Security review · Succinct Labs · 2023-02 · Crypto) — https://trailofbits.com/library/succinct-zk-light-client/
- Succinct Light Client (Security review · Succinct Labs · 2023-02 · Blockchain) — https://trailofbits.com/library/succinct-light-client/
- Nested Finance (Security review · Nested Finance · 2023-02 · Blockchain) — https://trailofbits.com/library/nested-finance/
- Token-2022 Program (Security review · Solana · 2023-02 · Blockchain) — https://trailofbits.com/library/token-2022-program/
- Careful with MAc-then-SIGn: A Computational Analysis of the EDHOC Lightweight Authenticated Key Exchange Protocol (Academic paper · 2023) — https://trailofbits.com/library/careful-with-mac-then-sign-a-computational-analysis-of-the-edhoc-light/
- Weak Fiat-Shamir Attacks on Modern Proof Systems (Academic paper · 2023 · Crypto) — https://trailofbits.com/library/weak-fiat-shamir-attacks-on-modern-proof-systems-2023/
- Endoprocess: Programmable and Extensible Subprocess Isolation (Academic paper · 2023) — https://trailofbits.com/library/endoprocess-programmable-and-extensible-subprocess-isolation/
- CIVSCOPE: Analyzing Potential Memory Corruption Bugs in Compartment Interfaces (Academic paper · 2023) — https://trailofbits.com/library/civscope-analyzing-potential-memory-corruption-bugs-in-compartment-int/
- Detecting variability bugs through hybrid control and data flow analysis (Academic paper · 2023) — https://trailofbits.com/library/detecting-variability-bugs-through-hybrid-control-and-data-flow-analys/
- Blind Spots: Automatically detecting ignored program inputs (Academic paper · 2023) — https://trailofbits.com/library/blind-spots-automatically-detecting-ignored-program-inputs/
- Efficient Proofs of Software Exploitability for Real-world Processors (Academic paper · 2023) — https://trailofbits.com/library/efficient-proofs-of-software-exploitability-for-real-world-processors/
- Toward Comprehensive Risk Assessments and Assurance of AI Systems (Academic paper · 2023) — https://trailofbits.com/library/toward-comprehensive-risk-assessments-and-assurance-of-ai-systems/
- Your Mitigations are My Opportunities (Conference talk · 2023 · Systems) — https://trailofbits.com/library/your-mitigations-are-my-opportunities/
- Detecting variability bugs with hybrid control and data flow (Conference talk · 2023 · Systems) — https://trailofbits.com/library/detecting-variability-bugs-with-hybrid-control-and-data-flow/
- Blind Spots: Identifying Exploitable Program Inputs (Conference talk · 2023 · Systems) — https://trailofbits.com/library/blind-spots-identifying-exploitable-program-inputs/
- MLIR is the future of program analysis (Conference talk · 2023 · Systems) — https://trailofbits.com/library/mlir-is-the-future-of-program-analysis/
- Test your tests: the do's and don'ts of testing (Conference talk · 2023 · Blockchain) — https://trailofbits.com/library/test-your-tests-the-do-s-and-don-ts-of-testing/
- Slither: a static analysis tool for Vyper and Solidity (Conference talk · 2023 · Blockchain) — https://trailofbits.com/library/slither-a-static-analysis-tool-for-vyper-and-solidity/
- Roundme: rounding analysis made simpler (Conference talk · 2023 · Blockchain) — https://trailofbits.com/library/roundme-rounding-analysis-made-simpler/
- Smart Contracts: The Beta (Conference talk · 2023 · Blockchain) — https://trailofbits.com/library/smart-contracts-the-beta/
- Fuzzing like a security engineer (Conference talk · 2023 · Blockchain) — https://trailofbits.com/library/fuzzing-like-a-security-engineer/
- Careful with MAc-then-SIGn (Conference talk · 2023 · Crypto) — https://trailofbits.com/library/careful-with-mac-then-sign/
- Using Graph-Based Machine Learning Algorithms for Software Analysis (Conference talk · 2023 · AI/ML) — https://trailofbits.com/library/using-graph-based-machine-learning-algorithms-for-software-analysis/
- What does it look like to code-sign for an entire packaging ecosystem? (Conference talk · 2023 · Supply Chain) — https://trailofbits.com/library/what-does-it-look-like-to-code-sign-for-an-entire-packaging-ecosystem/
- Securing your Package Ecosystem with Trusted Publishing (Conference talk · 2023 · Supply Chain) — https://trailofbits.com/library/securing-your-package-ecosystem-with-trusted-publishing/
- Trusted Publishing: Lessons from PyPI (Conference talk · 2023 · Supply Chain) — https://trailofbits.com/library/trusted-publishing-lessons-from-pypi/
- Ergonomic codesigning for the Python ecosystem with Sigstore (Conference talk · 2023 · Supply Chain) — https://trailofbits.com/library/ergonomic-codesigning-for-the-python-ecosystem-with-sigstore/
- Risky Biz 690 (Podcast · 2023-01) — https://trailofbits.com/library/risky-biz-690/
- Fraxlend and veFPIS (Security review · Frax Finance · 2023-01 · Blockchain) — https://trailofbits.com/library/frax-finance-fraxlend-and-vefpis/
- noble-curves Library (Security review · Citizen Technologies · 2023-01 · Crypto) — https://trailofbits.com/library/noble-curves-library/
- Redpanda Platform (Security review · 2023-01 · AppSec) — https://trailofbits.com/library/redpanda-platform/
- Injective Labs Options Market (Security review · 2023-01 · AppSec) — https://trailofbits.com/library/injective-labs-options-market/
- OpenVPN3 (Security review · 2023-01 · AppSec) — https://trailofbits.com/library/openvpn3/
- Polygon Edge (Security review · 2023-01 · Blockchain) — https://trailofbits.com/library/polygon-edge/
- Billion hashes attack against Go JOSE libraries (Disclosure · go-jose · 2023) — https://trailofbits.com/library/go-jose-billion-hashes-attack-against-go-jose-libraries/
- Expo Secure Store: Shortening AES GCM Authentication Tags (Disclosure · expo-secure-store · 2023) — https://trailofbits.com/library/expo-secure-store-expo-secure-store-shortening-aes-gcm-authentication/
- YOLOv7 disclosure (Disclosure · YOLOv7 · 2023) — https://trailofbits.com/library/yolov7-disclosure/
- Numbers turned weapons: DoS in Osmosis’ math library (Disclosure · Osmosis · 2023) — https://trailofbits.com/library/numbers-turned-weapons-dos-in-osmosis-math-library/
- The issue with ATS in Apple’s macOS and iOS (Disclosure · Apple · 2023) — https://trailofbits.com/library/ios-ipados-tvos-macos-and-watchos-the-issue-with-ats-in-apple-s-macos/
- Eth ABI DoS disclosure (Disclosure · Multiple · 2023) — https://trailofbits.com/library/ethabi-ethabi-etheriumjs-abi-alloy-rs-eth-abi-dos-disclosure/
- L2 finality bugs in Juno and Pathfinder (Disclosure · Multiple · 2023) — https://trailofbits.com/library/juno-pathfinder-l2-finality-bugs-in-juno-and-pathfinder/
- Security flaws in an SSO plugin for Caddy (Disclosure · caddy-security · 2023) — https://trailofbits.com/library/caddy-security-security-flaws-in-an-sso-plugin-for-caddy/
- ktor Path Traversal (Disclosure · ktor · 2023) — https://trailofbits.com/library/ktor-path-traversal/
- ParaSpace (Security review · Paraspace · 2022-12 · Crypto) — https://trailofbits.com/library/paraspace/
- OpenVPN2 (Security review · OpenVPN, Inc · 2022-12 · AppSec) — https://trailofbits.com/library/openvpn2/
- OpenArchive Save (Android) (Security review · Open Technology Fund · 2022-12 · AppSec) — https://trailofbits.com/library/openarchive-save-android/
- KEDA (Security review · Linux Foundation · 2022-12 · Supply Chain) — https://trailofbits.com/library/keda/
- Optimism (Security review · 2022-12 · Blockchain) — https://trailofbits.com/library/optimism/
- Paxos PayPal PYUSD (Security review · Paxos · 2022-12 · Blockchain) — https://trailofbits.com/library/paxos-paypal-pyusd/
- Nostra (Security review · 2022-12 · Blockchain) — https://trailofbits.com/library/nostra/
- StarkGate (Security review · 2022-12 · Blockchain) — https://trailofbits.com/library/starkgate/
- Drift Protocol (Security review · Drift Protocol · 2022-12 · Blockchain) — https://trailofbits.com/library/drift-protocol/
- ParaSpace (Security review · Substrate · 2022-12 · Blockchain) — https://trailofbits.com/library/paraspace-2022/
- Phantom Wallet (Security review · 2022-11 · Crypto) — https://trailofbits.com/library/phantom-wallet/
- ParaSpace (Security review · Paraspace · 2022-11 · Crypto) — https://trailofbits.com/library/paraspace-2/
- Enclave Markets (Security review · 2022-11 · AppSec) — https://trailofbits.com/library/enclave-markets/
- Fiat Ramps (Security review · 2022-11 · AppSec) — https://trailofbits.com/library/fiat-ramps/
- Terraform Enterprise (Security review · 2022-11 · Supply Chain) — https://trailofbits.com/library/terraform-enterprise/
- Nomad Enterprise (Security review · 2022-11 · Supply Chain) — https://trailofbits.com/library/nomad-enterprise/
- Phantom Wallet (Security review · 2022-11 · Blockchain) — https://trailofbits.com/library/phantom-wallet-2022/
- GameStop iOS Web Wallet (Security review · 2022-11 · Blockchain) — https://trailofbits.com/library/gamestop-ios-web-wallet/
- Folks Finance Protocol (Security review · Folks Finance · 2022-11 · Blockchain) — https://trailofbits.com/library/folks-finance-protocol/
- ParaSpace (Security review · Substrate · 2022-11 · Blockchain) — https://trailofbits.com/library/paraspace-3/
- Fraxlend and FraxFerry (Security review · Frax Finance · 2022-10 · Blockchain) — https://trailofbits.com/library/frax-finance-fraxlend-and-fraxferry/
- SimpleX Chat (Security review · SimpleX · 2022-10 · Crypto) — https://trailofbits.com/library/simplex-chat/
- cURL (Security review · 2022-10 · AppSec) — https://trailofbits.com/library/curl/
- CloudEvents (Security review · 2022-10 · AppSec) — https://trailofbits.com/library/cloudevents/
- OpenArchive Save (iOS) (Security review · Open Technology Fund · 2022-10 · AppSec) — https://trailofbits.com/library/openarchive-save-ios/
- GSquared (Security review · Growth Labs · 2022-10 · Blockchain) — https://trailofbits.com/library/gsquared/
- Meson Protocol (Security review · Meson · 2022-10 · Blockchain) — https://trailofbits.com/library/meson-protocol/
- Managed Pools (Security review · Balancer · 2022-10 · Blockchain) — https://trailofbits.com/library/managed-pools/
- Ondo (Security review · Ondo Finance · 2022-10 · Blockchain) — https://trailofbits.com/library/ondo/
- StarkEx (Security review · 2022-10 · Blockchain) — https://trailofbits.com/library/starkex/
- Dfinity (Security review · DFINITY · 2022-09 · Crypto) — https://trailofbits.com/library/dfinity/
- Aleo snarkVM (Security review · Aleo Systems · 2022-09 · Crypto) — https://trailofbits.com/library/aleo-snarkvm/
- AlphaSOC API (Security review · AlphaSOC, Inc · 2022-09 · AppSec) — https://trailofbits.com/library/alphasoc-api/
- Consul Enterprise (Security review · 2022-09 · AppSec) — https://trailofbits.com/library/consul-enterprise/
- snarkVM (Security review · Aleo Systems · 2022-09 · AppSec) — https://trailofbits.com/library/snarkvm/
- Maple Protocol v2 (Security review · Maple Labs · 2022-09 · Blockchain) — https://trailofbits.com/library/maple-protocol-v2/
- Increment Protocol (Security review · Increment Finance · 2022-09 · Blockchain) — https://trailofbits.com/library/increment-protocol/
- Subspace Farmer (Security review · Subspace Network · 2022-09 · Blockchain) — https://trailofbits.com/library/subspace-farmer/
- Optimism (Security review · Optimism · 2022-09 · Blockchain) — https://trailofbits.com/library/optimism-2022/
- Nayms (Security review · 2022-09 · Blockchain) — https://trailofbits.com/library/nayms/
- DFINITY Canister Sandbox (Security review · DFINITY · 2022-09 · Blockchain) — https://trailofbits.com/library/dfinity-canister-sandbox/
- DFINITY ECDSA/BTC (Security review · DFINITY · 2022-09 · Blockchain) — https://trailofbits.com/library/dfinity-ecdsa-btc/
- Reserve Protocol (Security review · Reserve Protocol · 2022-08 · Blockchain) — https://trailofbits.com/library/reserve-protocol/
- Uniswap Mobile Wallet (Security review · Uniswap · 2022-08 · Blockchain) — https://trailofbits.com/library/uniswap-mobile-wallet/
- Aggregator (Security review · 2022-08 · Blockchain) — https://trailofbits.com/library/aggregator/
- The Franchiser (Security review · 2022-08 · Blockchain) — https://trailofbits.com/library/the-franchiser/
- Risky Biz 672 (Podcast · 2022-07) — https://trailofbits.com/library/risky-biz-672/
- MobileCoin (Security review · MobileCoin · 2022-07 · Blockchain) — https://trailofbits.com/library/mobilecoin/
- Microsoft/Verasion Go-COSE (Security review · Microsoft · 2022-07 · Crypto) — https://trailofbits.com/library/microsoft-verasion-go-cose/
- BLS Signature Scheme (Security review · 2022-07 · Crypto) — https://trailofbits.com/library/bls-signature-scheme/
- Hashicorp Boundary (Security review · 2022-07 · AppSec) — https://trailofbits.com/library/hashicorp-boundary/
- Skiff (Security review · 2022-07 · AppSec) — https://trailofbits.com/library/skiff/
- Meson Protocol (Security review · Ethereum/EVM · 2022-07 · Blockchain) — https://trailofbits.com/library/meson-protocol-2022/
- ChainPort (Security review · DcentraLab · 2022-07 · Blockchain) — https://trailofbits.com/library/chainport/
- Relay (Security review · 2022-07 · Blockchain) — https://trailofbits.com/library/relay/
- Beanstalk (Security review · Beanstalk · 2022-07 · Blockchain) — https://trailofbits.com/library/beanstalk/
- Purpose for Profit (Security review · 2022-07 · Blockchain) — https://trailofbits.com/library/purpose-for-profit/
- Solon (Security review · 2022-07 · Blockchain) — https://trailofbits.com/library/solon/
- Roll (Security review · 2022-07 · Blockchain) — https://trailofbits.com/library/roll/
- StarkNet token (Security review · 2022-07 · Blockchain) — https://trailofbits.com/library/starknet-token/
- FROST BLS Protocols (Security review · 2022-07 · Blockchain) — https://trailofbits.com/library/frost-bls-protocols/
- SORA Trustless Bridge (Security review · 2022-07 · Blockchain) — https://trailofbits.com/library/sora-trustless-bridge/
- Are Blockchains Decentralized? Unintended Centralities in Distributed Ledgers (Whitepaper · 2022-06 · Blockchain) — https://trailofbits.com/library/are-blockchains-decentralized-unintended-centralities-in-distributed-l/
- Do You Really Need a Blockchain? An Operational Risk Assessment (Whitepaper · 2022-06 · Blockchain) — https://trailofbits.com/library/do-you-really-need-a-blockchain-an-operational-risk-assessment/
- Cloud Security Reinvented (Podcast · 2022-06) — https://trailofbits.com/library/cloud-security-reinvented/
- Terraform Cloud (Security review · 2022-06 · AppSec) — https://trailofbits.com/library/terraform-cloud/
- HashiCorp Cloud (Security review · 2022-06 · Supply Chain) — https://trailofbits.com/library/hashicorp-cloud/
- Alkimiya Silica V2 (Security review · 2022-06 · Blockchain) — https://trailofbits.com/library/alkimiya-silica-v2/
- Sherlock (Security review · 2022-06 · Blockchain) — https://trailofbits.com/library/sherlock/
- FlareFinance (Security review · 2022-06 · Blockchain) — https://trailofbits.com/library/flarefinance/
- TBTv2 (Security review · 2022-06 · Blockchain) — https://trailofbits.com/library/tbtv2/
- Morpho (Security review · Morpho Labs · 2022-06 · Blockchain) — https://trailofbits.com/library/morpho/
- Relayer Contracts (Security review · 2022-06 · Blockchain) — https://trailofbits.com/library/relayer-contracts/
- CAT Standard (Security review · 2022-06 · Blockchain) — https://trailofbits.com/library/cat-standard/
- Frax (Security review · Frax Finance · 2022-05 · Blockchain) — https://trailofbits.com/library/frax-finance-frax/
- Binance CGGMP21 and FROST (Security review · 2022-05 · Crypto) — https://trailofbits.com/library/binance-cggmp21-and-frost/
- Datadog (Security review · 2022-05 · AppSec) — https://trailofbits.com/library/datadog/
- MATTR (Security review · 2022-05 · AppSec) — https://trailofbits.com/library/mattr/
- Ante Protocol (Security review · Ante Labs LLC · 2022-05 · Blockchain) — https://trailofbits.com/library/ante-protocol/
- AuctionRaffle (Security review · 2022-05 · Blockchain) — https://trailofbits.com/library/auctionraffle/
- Seaport Protocol (Security review · OpenSea · 2022-05 · Blockchain) — https://trailofbits.com/library/seaport-protocol/
- Shell Protocol v2 (Security review · Cowri Labs · 2022-05 · Blockchain) — https://trailofbits.com/library/shell-protocol-v2/
- DFINITY Threshold ECDSA (Security review · 2022-05 · Blockchain) — https://trailofbits.com/library/dfinity-threshold-ecdsa/
- ArmorLock (Security review · Western Digital · 2022-04 · AppSec) — https://trailofbits.com/library/western-digital-armorlock/
- Aleo snarkVM & snarkOS (Security review · 2022-04 · Crypto) — https://trailofbits.com/library/aleo-snarkvm-snarkos/
- Phantom Wallet (Security review · 2022-04 · Crypto) — https://trailofbits.com/library/phantom-wallet-2/
- ArmorLock (Security review · 2022-04 · AppSec) — https://trailofbits.com/library/armorlock/
- DigitalOcean Function (Security review · 2022-04 · AppSec) — https://trailofbits.com/library/digitalocean-function/
- Auvik Collector (Security review · 2022-04 · AppSec) — https://trailofbits.com/library/auvik-collector/
- Ava Labs (Security review · 2022-04 · Blockchain) — https://trailofbits.com/library/ava-labs/
- Optimism (Security review · 2022-04 · Blockchain) — https://trailofbits.com/library/optimism-2/
- NFTX (Security review · NFTX · 2022-04 · Blockchain) — https://trailofbits.com/library/nftx/
- ReserveLending+ (Security review · 2022-04 · Blockchain) — https://trailofbits.com/library/reservelending/
- Firefly (Security review · 2022-04 · Blockchain) — https://trailofbits.com/library/firefly/
- Solana (Security review · 2022-04 · Blockchain) — https://trailofbits.com/library/solana/
- Kolibri (Security review · 2022-04 · Blockchain) — https://trailofbits.com/library/kolibri/
- Skiff Office Hours (Podcast · 2022-03) — https://trailofbits.com/library/skiff-office-hours/
- Parallel Finance (Security review · Parallel Finance · 2022-03 · Crypto) — https://trailofbits.com/library/parallel-finance/
- Fuchsia Platform (Security review · 2022-03 · AppSec) — https://trailofbits.com/library/fuchsia-platform/
- BitcoinBeach (Security review · Galoy · 2022-03 · Blockchain) — https://trailofbits.com/library/bitcoinbeach/
- Tekton (Security review · Linux Foundation · 2022-03 · Supply Chain) — https://trailofbits.com/library/tekton/
- GameStop Wallet (Security review · 2022-03 · Blockchain) — https://trailofbits.com/library/gamestop-wallet/
- Maple Finance (Security review · Maple Labs · 2022-03 · Blockchain) — https://trailofbits.com/library/maple-finance/
- Gyroscope (Security review · 2022-03 · Blockchain) — https://trailofbits.com/library/gyroscope/
- LooksRare (Security review · LooksRare · 2022-03 · Blockchain) — https://trailofbits.com/library/looksrare/
- Symbiosis (Security review · 2022-03 · Blockchain) — https://trailofbits.com/library/symbiosis/
- Parallel Finance (Security review · Parallel Finance · 2022-03 · Blockchain) — https://trailofbits.com/library/parallel-finance-2022/
- Arbitrum Nitro (Security review · 2022-03 · Blockchain) — https://trailofbits.com/library/arbitrum-nitro/
- Polkadex (Security review · 2022-02 · Crypto) — https://trailofbits.com/library/polkadex/
- Linkerd (Security review · 2022-02 · Supply Chain) — https://trailofbits.com/library/linkerd/
- RAILGUN (Security review · 2022-02 · Blockchain) — https://trailofbits.com/library/railgun/
- RAILWAY (Security review · 2022-02 · Blockchain) — https://trailofbits.com/library/railway/
- Persistence ETH2.0 (Security review · 2022-02 · Blockchain) — https://trailofbits.com/library/persistence-eth2-0/
- Advanced Blockchain (Security review · Advanced Blockchain · 2022-02 · Blockchain) — https://trailofbits.com/library/advanced-blockchain/
- Perpetual Protocol V2 (Security review · Perpetual Finance · 2022-02 · Blockchain) — https://trailofbits.com/library/perpetual-protocol-v2/
- Futureswap V4.1 (Security review · 2022-02 · Blockchain) — https://trailofbits.com/library/futureswap-v4-1/
- Firefly (Security review · 2022-02 · Blockchain) — https://trailofbits.com/library/firefly-2022/
- API3 (Security review · API3 · 2022-02 · Blockchain) — https://trailofbits.com/library/api3/
- Beethoven X (Security review · Beethoven X · 2022-02 · Blockchain) — https://trailofbits.com/library/beethoven-x/
- Polkadex (Security review · 2022-02 · Blockchain) — https://trailofbits.com/library/polkadex-2022/
- Umee (Security review · Umee · 2022-02 · Blockchain) — https://trailofbits.com/library/umee/
- DeGate (Security review · DeGate · 2022-02 · Blockchain) — https://trailofbits.com/library/degate/
- A Broad Comparative Evaluation of x86-64 Binary Rewriters (Academic paper · 2022 · Systems) — https://trailofbits.com/library/a-broad-comparative-evaluation-of-x86-64-binary-rewriters/
- On the Optimization of Equivalent Concurrent Computations (Academic paper · 2022) — https://trailofbits.com/library/on-the-optimization-of-equivalent-concurrent-computations/
- Write better smart contracts with Slither's Python API (Conference talk · 2022 · Blockchain) — https://trailofbits.com/library/write-better-smart-contracts-with-slither-s-python-api/
- Building Secure Cairo (Conference talk · 2022 · Blockchain) — https://trailofbits.com/library/building-secure-cairo/
- How to fuzz like a pro (Conference talk · 2022 · Blockchain) — https://trailofbits.com/library/how-to-fuzz-like-a-pro/
- Demystifying Fuzzing (Conference talk · 2022 · Blockchain) — https://trailofbits.com/library/demystifying-fuzzing/
- VAST: MLIR for program analysis of C/C++ (Conference talk · 2022 · Systems) — https://trailofbits.com/library/vast-mlir-for-program-analysis-of-c-c/
- A Broad Comparative Evaluation of x86-64 Binary Rewriters (Conference talk · 2022 · Systems) — https://trailofbits.com/library/a-broad-comparative-evaluation-of-x86-64-binary-rewriters-2022/
- On the Optimization of Equivalent Concurrent Computations (Conference talk · 2022 · Systems) — https://trailofbits.com/library/on-the-optimization-of-equivalent-concurrent-computations-2022/
- die, PGP, die (Conference talk · 2022 · Crypto) — https://trailofbits.com/library/die-pgp-die/
- A mostly gentle introduction to LLVM (Conference talk · 2022 · Systems) — https://trailofbits.com/library/a-mostly-gentle-introduction-to-llvm/
- Sigstore for Python Packaging: Next Steps for Adoption (Conference talk · 2022 · Supply Chain) — https://trailofbits.com/library/sigstore-for-python-packaging-next-steps-for-adoption/
- Python Packaging Mystery Meat (Conference talk · 2022 · Supply Chain) — https://trailofbits.com/library/python-packaging-mystery-meat/
- Automated Tools for Securing the Software Supply Chain (Conference talk · 2022 · Supply Chain) — https://trailofbits.com/library/automated-tools-for-securing-the-software-supply-chain/
- Risky Biz 652 (Podcast · 2022-01) — https://trailofbits.com/library/risky-biz-652/
- Optimus ROM (Security review · Western Digital · 2022-01 · AppSec) — https://trailofbits.com/library/western-digital-optimus-rom/
- Optimus ROM (Security review · 2022-01 · AppSec) — https://trailofbits.com/library/optimus-rom/
- osquery (Security review · Atlassian · 2022-01 · AppSec) — https://trailofbits.com/library/osquery/
- CoreDNS (Security review · Linux Foundation · 2022-01 · Supply Chain) — https://trailofbits.com/library/coredns/
- Minterest Finance (Security review · 2022-01 · Blockchain) — https://trailofbits.com/library/minterest-finance/
- pSTAKE (Security review · 2022-01 · Blockchain) — https://trailofbits.com/library/pstake/
- Primitive (Security review · Primitive · 2022-01 · Blockchain) — https://trailofbits.com/library/primitive/
- Strips Finance (Security review · 2022-01 · Blockchain) — https://trailofbits.com/library/strips-finance/
- StarkPerpetual (Security review · 2022-01 · Blockchain) — https://trailofbits.com/library/starkperpetual/
- Columbus-5 (Security review · 2022-01 · Blockchain) — https://trailofbits.com/library/columbus-5/
- Specialized Zero-Knowledge Proof failures (Disclosure · Multiple · 2022 · Crypto) — https://trailofbits.com/library/binance-s-tss-lib-all-forks-of-tss-lib-joltify-swipechain-and-thorchai/
- Forgery in Amis' Alice library (Disclosure · Amis' alice · 2022) — https://trailofbits.com/library/forgery-in-amis-alice-library/
- Keeping the wolves out of wolfSSL (Disclosure · wolfSSL · 2022) — https://trailofbits.com/library/keeping-the-wolves-out-of-wolfssl/
- Escaping misconfigured VSCode extensions - Live Preview XSS (Disclosure · Live Preview VSCode extension · 2022) — https://trailofbits.com/library/live-preview-vscode-extension-escaping-misconfigured-vscode-extensions/
- Escaping misconfigured VSCode extensions - Live Preview Path Traversal (Disclosure · Live Preview VSCode extension · 2022) — https://trailofbits.com/library/live-preview-vscode-extension-escaping-misconfigured-vscode-extensions-2022/
- Escaping well-configured VSCode extensions (for profit) - VSCode localResourceRoots Bypass (Disclosure · VSCode · 2022) — https://trailofbits.com/library/escaping-well-configured-vscode-extensions-for-profit-vscode-localreso/
- Escaping misconfigured VSCode extensions - Sarif Viewer XSS (Disclosure · Sarif Viewer VSCode extension · 2022) — https://trailofbits.com/library/sarif-viewer-vscode-extension-escaping-misconfigured-vscode-extensions/
- Stranger Strings: An exploitable flaw in SQLite (Disclosure · SQLite · 2022) — https://trailofbits.com/library/stranger-strings-an-exploitable-flaw-in-sqlite/
- json-viewer XSS (Disclosure · jquery.json-viewer · 2022) — https://trailofbits.com/library/jquery-json-viewer-json-viewer-xss/
- ERC721 improper token transfer in cairo-contracts (Disclosure · OpenZeppelin cairo-contracts · 2022) — https://trailofbits.com/library/openzeppelin-cairo-contracts-erc721-improper-token-transfer-in-cairo-c/
- Frax (Security review · Frax Finance · 2021-12 · Blockchain) — https://trailofbits.com/library/frax-finance-frax-2021/
- Redjack (Security review · 2021-12 · AppSec) — https://trailofbits.com/library/redjack/
- Cardstack (Security review · 2021-12 · Blockchain) — https://trailofbits.com/library/cardstack/
- Sherlock Protocol V2 (Security review · Sherlock · 2021-12 · Blockchain) — https://trailofbits.com/library/sherlock-protocol-v2/
- Polkadex (Security review · 2021-12 · Blockchain) — https://trailofbits.com/library/polkadex-2021/
- IBC Protocol (Security review · 2021-12 · Blockchain) — https://trailofbits.com/library/ibc-protocol/
- ShardX (Security review · 2021-12 · Blockchain) — https://trailofbits.com/library/shardx/
- DeGate (Security review · 2021-12 · Blockchain) — https://trailofbits.com/library/degate-2021/
- Secureum Safecast #3 (Podcast · 2021-11) — https://trailofbits.com/library/secureum-safecast-3/
- DigitalOcean Cloud (Security review · 2021-11 · AppSec) — https://trailofbits.com/library/digitalocean-cloud/
- Terraform Enterprise (Security review · 2021-11 · Supply Chain) — https://trailofbits.com/library/terraform-enterprise-2021/
- Nomad Enterprise (Security review · 2021-11 · Supply Chain) — https://trailofbits.com/library/nomad-enterprise-2021/
- Maple (Security review · Maple Labs · 2021-11 · Blockchain) — https://trailofbits.com/library/maple/
- Advanced Blockchain (Security review · Advanced Blockchain · 2021-11 · Blockchain) — https://trailofbits.com/library/advanced-blockchain-2021/
- Opyn (Security review · Opyn · 2021-11 · Blockchain) — https://trailofbits.com/library/opyn/
- Aave V3 (Security review · Aave · 2021-11 · Blockchain) — https://trailofbits.com/library/aave-v3/
- StarkEx (Security review · 2021-11 · Blockchain) — https://trailofbits.com/library/starkex-2021/
- Threshold-DSA (Security review · 2021-11 · Blockchain) — https://trailofbits.com/library/threshold-dsa/
- DFINITY Consensus (Security review · DFINITY · 2021-11 · Blockchain) — https://trailofbits.com/library/dfinity-consensus/
- Secureum Safecast #2 (Podcast · 2021-10) — https://trailofbits.com/library/secureum-safecast-2/
- SpruceID (Security review · Tezos · 2021-10 · AppSec) — https://trailofbits.com/library/spruceid/
- Consul Enterprise (Security review · 2021-10 · Supply Chain) — https://trailofbits.com/library/consul-enterprise-2021/
- Vault Enterprise (Security review · 2021-10 · Supply Chain) — https://trailofbits.com/library/vault-enterprise/
- STAS SDK (Security review · 2021-10 · Blockchain) — https://trailofbits.com/library/stas-sdk/
- Tokemak (Security review · 2021-10 · Blockchain) — https://trailofbits.com/library/tokemak/
- Fuji Finance (Security review · Fuji Protocol · 2021-10 · Blockchain) — https://trailofbits.com/library/fuji-finance/
- V2 Vault (Security review · 2021-10 · Blockchain) — https://trailofbits.com/library/v2-vault/
- PolySign HSM (Security review · 2021-10 · Blockchain) — https://trailofbits.com/library/polysign-hsm/
- Doppler (Security review · 2021-09 · AppSec) — https://trailofbits.com/library/doppler/
- STAS-JS SDK (Security review · 2021-09 · Blockchain) — https://trailofbits.com/library/stas-js-sdk/
- Yield V2 (Security review · Yield · 2021-09 · Blockchain) — https://trailofbits.com/library/yield-v2/
- Gro protocol (Security review · 2021-09 · Blockchain) — https://trailofbits.com/library/gro-protocol/
- Futureswap V4 (Security review · 2021-09 · Blockchain) — https://trailofbits.com/library/futureswap-v4/
- PINT (Security review · 2021-09 · Blockchain) — https://trailofbits.com/library/pint/
- Hop Protocol V2 (Security review · 2021-09 · Blockchain) — https://trailofbits.com/library/hop-protocol-v2/
- Golden Gate Library (Security review · 2021-09 · Blockchain) — https://trailofbits.com/library/golden-gate-library/
- PolySign (Security review · 2021-09 · Blockchain) — https://trailofbits.com/library/polysign/
- Qredo Blockchain (Security review · 2021-09 · Blockchain) — https://trailofbits.com/library/qredo-blockchain/
- Arbitrum (Security review · 2021-09 · Blockchain) — https://trailofbits.com/library/arbitrum/
- Datadog Agent (Security review · 2021-08 · AppSec) — https://trailofbits.com/library/datadog-agent/
- RocketPool (Security review · Rocket Pool · 2021-08 · Blockchain) — https://trailofbits.com/library/rocketpool/
- AlphaX (Security review · 2021-08 · Blockchain) — https://trailofbits.com/library/alphax/
- Bug Bounty Platform (Security review · 2021-08 · Blockchain) — https://trailofbits.com/library/bug-bounty-platform/
- 88mph V3 (Security review · 88mph · 2021-08 · Blockchain) — https://trailofbits.com/library/88mph-v3/
- Polkaswap (Security review · Soramitsu · 2021-08 · Blockchain) — https://trailofbits.com/library/polkaswap/
- THORChain (Security review · 2021-08 · Blockchain) — https://trailofbits.com/library/thorchain/
- go-schnorrkel (Security review · 2021-08 · Blockchain) — https://trailofbits.com/library/go-schnorrkel/
- ShardX (Security review · 2021-08 · Blockchain) — https://trailofbits.com/library/shardx-2021/
- Press Freedom Foundation (Podcast · 2021-07) — https://trailofbits.com/library/press-freedom-foundation/
- Casper Web Wallet (Security review · Casper · 2021-07 · Blockchain) — https://trailofbits.com/library/casper-web-wallet/
- Timeswap (Security review · 2021-07 · Blockchain) — https://trailofbits.com/library/timeswap/
- CompliFi (Security review · CompliFi · 2021-07 · Blockchain) — https://trailofbits.com/library/complifi/
- Optics (Security review · 2021-07 · Blockchain) — https://trailofbits.com/library/optics/
- AElf (Security review · 2021-07 · Blockchain) — https://trailofbits.com/library/aelf/
- CrossChain-Bridge (Security review · 2021-07 · Blockchain) — https://trailofbits.com/library/crosschain-bridge/
- Uniswap V3 Staker (Security review · Uniswap · 2021-06 · Blockchain) — https://trailofbits.com/library/uniswap-v3-staker/
- Appian (Security review · 2021-06 · AppSec) — https://trailofbits.com/library/appian/
- Cashero-2.0 (Security review · 2021-06 · AppSec) — https://trailofbits.com/library/cashero-2-0/
- HashiCorp Cloud (Security review · 2021-06 · Supply Chain) — https://trailofbits.com/library/hashicorp-cloud-2021/
- FlareFinance (Security review · 2021-06 · Blockchain) — https://trailofbits.com/library/flarefinance-2021/
- Abyss Lockup (Security review · 2021-06 · Blockchain) — https://trailofbits.com/library/abyss-lockup/
- Futureswap V3 (Security review · 2021-06 · Blockchain) — https://trailofbits.com/library/futureswap-v3/
- CompliFi (Security review · 2021-06 · Blockchain) — https://trailofbits.com/library/complifi-2021/
- xUDT (Security review · 2021-06 · Blockchain) — https://trailofbits.com/library/xudt/
- AlephBFT (Security review · Aleph Zero Foundation · 2021-06 · Blockchain) — https://trailofbits.com/library/alephbft/
- Acala Network (Security review · 2021-06 · Blockchain) — https://trailofbits.com/library/acala-network/
- Frax (Security review · Frax Finance · 2021-05 · Blockchain) — https://trailofbits.com/library/frax-finance-frax-2/
- Syndicate (Security review · 2021-05 · Blockchain) — https://trailofbits.com/library/syndicate/
- Opyn Gamma (Security review · Ethereum/EVM · 2021-05 · Blockchain) — https://trailofbits.com/library/opyn-gamma/
- Compound Chain (Security review · 2021-05 · Blockchain) — https://trailofbits.com/library/compound-chain/
- DFINITY (Security review · DFINITY · 2021-05 · Blockchain) — https://trailofbits.com/library/dfinity-2021/
- Linux Kernel (Security review · 2021-04 · Crypto) — https://trailofbits.com/library/linux-kernel/
- Orbit (Security review · 2021-04 · AppSec) — https://trailofbits.com/library/orbit/
- VGS Proxy (Security review · 2021-04 · AppSec) — https://trailofbits.com/library/vgs-proxy/
- Yearn v2 Vaults (Security review · Yearn Finance · 2021-04 · Blockchain) — https://trailofbits.com/library/yearn-v2-vaults/
- Balancer v2 (Security review · Balancer · 2021-04 · Blockchain) — https://trailofbits.com/library/balancer-v2/
- DFX Finance (Security review · 2021-04 · Blockchain) — https://trailofbits.com/library/dfx-finance/
- Tokemak (Security review · 2021-04 · Blockchain) — https://trailofbits.com/library/tokemak-2021/
- Warp Contracts (Security review · Advanced Blockchain · 2021-04 · Blockchain) — https://trailofbits.com/library/warp-contracts/
- FlareFinance (Security review · 2021-04 · Blockchain) — https://trailofbits.com/library/flarefinance-2/
- Open Oracle (Security review · 2021-04 · Blockchain) — https://trailofbits.com/library/open-oracle/
- Employee Cycle (Podcast · 2021-03) — https://trailofbits.com/library/employee-cycle/
- Uniswap V3 (Security review · Uniswap · 2021-03 · Blockchain) — https://trailofbits.com/library/uniswap-v3/
- Argo (Security review · 2021-03 · Supply Chain) — https://trailofbits.com/library/argo/
- Flare Network (Security review · 2021-03 · Blockchain) — https://trailofbits.com/library/flare-network/
- MC Dai (Security review · 2021-03 · Blockchain) — https://trailofbits.com/library/mc-dai/
- dForce Lending (Security review · 2021-03 · Blockchain) — https://trailofbits.com/library/dforce-lending/
- Nervos -RSA (Security review · 2021-03 · Blockchain) — https://trailofbits.com/library/nervos-rsa/
- Risky Biz 614 (Podcast · 2021-02) — https://trailofbits.com/library/risky-biz-614/
- Skiff (Security review · 2021-02 · AppSec) — https://trailofbits.com/library/skiff-2021/
- Liquity Proxy Contract (Security review · Liquity · 2021-02 · Blockchain) — https://trailofbits.com/library/liquity-proxy-contract/
- Liquity Protocol (Security review · Liquity · 2021-02 · Blockchain) — https://trailofbits.com/library/liquity-protocol/
- RAY-DAO (Security review · 2021-02 · Blockchain) — https://trailofbits.com/library/ray-dao/
- Cheque Cell & ORU (Security review · 2021-02 · Blockchain) — https://trailofbits.com/library/cheque-cell-oru/
- Force Bridge - Solidity (Security review · 2021-02 · Blockchain) — https://trailofbits.com/library/force-bridge-solidity/
- Force Bridge - Rust (Security review · 2021-02 · Blockchain) — https://trailofbits.com/library/force-bridge-rust/
- Arbitrum V2 (Security review · 2021-02 · Blockchain) — https://trailofbits.com/library/arbitrum-v2/
- Evaluating Static Analysis Tools via Differential Mutation (Academic paper · 2021) — https://trailofbits.com/library/evaluating-static-analysis-tools-via-differential-mutation/
- echidna-parade: Diverse multicore smart contract fuzzing (Academic paper · 2021 · Systems) — https://trailofbits.com/library/echidna-parade-diverse-multicore-smart-contract-fuzzing/
- Differential analysis of x86-64 instruction decoders (Academic paper · 2021) — https://trailofbits.com/library/differential-analysis-of-x86-64-instruction-decoders/
- A Sermon on the Indulgences of Computational Sacrifice; or, The Superabundant Benedictions of Programming an Absurd NES Game (Conference talk · 2021 · Systems) — https://trailofbits.com/library/a-sermon-on-the-indulgences-of-computational-sacrifice-or-the-superabu/
- Differential analysis of x86-64 instruction decoders (Conference talk · 2021 · Systems) — https://trailofbits.com/library/differential-analysis-of-x86-64-instruction-decoders-2021/
- Building a Practical Static Analyzer for Smart Contracts (Conference talk · 2021 · Blockchain) — https://trailofbits.com/library/building-a-practical-static-analyzer-for-smart-contracts/
- Testing and Verifying Smart Contracts: From Theory to Practice (Conference talk · 2021 · Blockchain) — https://trailofbits.com/library/testing-and-verifying-smart-contracts-from-theory-to-practice/
- Safely integrating with ERC20 tokens (Conference talk · 2021 · Blockchain) — https://trailofbits.com/library/safely-integrating-with-erc20-tokens/
- JWTs, and why they suck (Conference talk · 2021 · Systems) — https://trailofbits.com/library/jwts-and-why-they-suck/
- Exploiting Machine Learning Pickle Files (Conference talk · 2021 · AI/ML) — https://trailofbits.com/library/exploiting-machine-learning-pickle-files/
- Building Better Systems 6 (Podcast · 2021-01) — https://trailofbits.com/library/building-better-systems-6/
- Fog Protocol (Security review · MobileCoin · 2021-01 · Blockchain) — https://trailofbits.com/library/mobilecoin-fog-protocol/
- CircleCI Server 3.0 (Security review · 2021-01 · AppSec) — https://trailofbits.com/library/circleci-server-3-0/
- BitMEX (Security review · 2021-01 · AppSec) — https://trailofbits.com/library/bitmex/
- Terraform Cloud (Security review · 2021-01 · Supply Chain) — https://trailofbits.com/library/terraform-cloud-2021/
- Bitcoin SV (Security review · 2021-01 · Blockchain) — https://trailofbits.com/library/bitcoin-sv/
- Futureswap (Security review · 2021-01 · Blockchain) — https://trailofbits.com/library/futureswap/
- Balancer V2 (Security review · 2021-01 · Blockchain) — https://trailofbits.com/library/balancer-v2-2021/
- C.R.E.A.M. (Security review · Ethereum/EVM · 2021-01 · Blockchain) — https://trailofbits.com/library/c-r-e-a-m/
- Acala Network (Security review · Acala · 2021-01 · Blockchain) — https://trailofbits.com/library/acala-network-2021/
- eFIL (Security review · 2021-01 · Blockchain) — https://trailofbits.com/library/efil/
- Shamir's Secret Sharing vulnerabilities (Disclosure · Multiple · 2021) — https://trailofbits.com/library/binance-s-tss-lib-clover-network-s-threshold-crypto-keep-network-s-kee/
- SecureDrop (Security review · Freedom of the Press Foundation · 2020-12 · AppSec) — https://trailofbits.com/library/securedrop/
- Citizen Browser (Security review · 2020-12 · AppSec) — https://trailofbits.com/library/citizen-browser/
- LUSD (Security review · Liquity · 2020-12 · Blockchain) — https://trailofbits.com/library/lusd/
- Tezori (T2) (Security review · Cryptonomic · 2020-12 · Blockchain) — https://trailofbits.com/library/tezori-t2/
- wXTZ (Security review · StakerDAO · 2020-11 · Blockchain) — https://trailofbits.com/library/wxtz/
- wALGO (Security review · StakerDAO · 2020-11 · Blockchain) — https://trailofbits.com/library/walgo/
- Origin Dollar (Security review · Origin Protocol · 2020-11 · Blockchain) — https://trailofbits.com/library/origin-dollar/
- Zerion SDK (Security review · 2020-11 · Blockchain) — https://trailofbits.com/library/zerion-sdk/
- Teller Protocol (Security review · 2020-11 · Blockchain) — https://trailofbits.com/library/teller-protocol/
- Hermez (Security review · Iden3 · 2020-11 · Blockchain) — https://trailofbits.com/library/hermez/
- Highway Consensus (Security review · Other/Multi-Chain · 2020-11 · Blockchain) — https://trailofbits.com/library/highway-consensus/
- MobileCoin BFT (Security review · MobileCoin · 2020-10 · Blockchain) — https://trailofbits.com/library/mobilecoin-bft/
- Consul (Security review · 2020-10 · Supply Chain) — https://trailofbits.com/library/consul/
- Graph Protocol (Security review · 2020-10 · Blockchain) — https://trailofbits.com/library/graph-protocol/
- OVM (Security review · 2020-10 · Blockchain) — https://trailofbits.com/library/ovm/
- Nervos SUDT (Security review · Decrypted Sapiens · 2020-10 · Blockchain) — https://trailofbits.com/library/nervos-sudt/
- WCBS 880 (Podcast · 2020-09) — https://trailofbits.com/library/wcbs-880/
- Prysm (Security review · 2020-09 · Blockchain) — https://trailofbits.com/library/prysm-2020/
- DODO (Security review · DODOEX · 2020-09 · Blockchain) — https://trailofbits.com/library/dodo/
- Stacks V2 (Security review · 2020-09 · Blockchain) — https://trailofbits.com/library/stacks-v2/
- Risky Biz 594 (Podcast · 2020-08) — https://trailofbits.com/library/risky-biz-594/
- MobileCoin (Security review · MobileCoin · 2020-08 · Blockchain) — https://trailofbits.com/library/mobilecoin-2020/
- Ren (Security review · 2020-08 · AppSec) — https://trailofbits.com/library/ren/
- Nomad (Security review · 2020-08 · Supply Chain) — https://trailofbits.com/library/nomad/
- Helm (Security review · Helm · 2020-08 · Supply Chain) — https://trailofbits.com/library/helm/
- Argent (Security review · 2020-08 · Blockchain) — https://trailofbits.com/library/argent/
- Yield Protocol (Security review · Yield · 2020-08 · Blockchain) — https://trailofbits.com/library/yield-protocol/
- Smart Pool (Security review · 2020-08 · Blockchain) — https://trailofbits.com/library/smart-pool/
- DeFiner (Security review · 2020-08 · Blockchain) — https://trailofbits.com/library/definer/
- ETH2.0 Deposit CLI (Security review · Ethereum Foundation · 2020-08 · Blockchain) — https://trailofbits.com/library/eth2-0-deposit-cli/
- VRFs (Security review · 2020-08 · Blockchain) — https://trailofbits.com/library/vrfs/
- Meld Gold (Security review · 2020-07 · Blockchain) — https://trailofbits.com/library/meld-gold/
- Zcoin (Security review · Zcoin · 2020-07 · Blockchain) — https://trailofbits.com/library/zcoin/
- CurveDAO (Security review · Swiss Stake · 2020-07 · Blockchain) — https://trailofbits.com/library/curvedao/
- Amp (Security review · Flexa · 2020-07 · Blockchain) — https://trailofbits.com/library/amp/
- Federated Bridge (Security review · 2020-07 · Blockchain) — https://trailofbits.com/library/federated-bridge/
- dForce dToken (Security review · dForce · 2020-07 · Blockchain) — https://trailofbits.com/library/dforce-dtoken/
- Celo Oracle (Security review · Celo · 2020-07 · Blockchain) — https://trailofbits.com/library/celo-oracle/
- Arbitrum (Security review · 2020-07 · Blockchain) — https://trailofbits.com/library/arbitrum-2020/
- MYKEY (Security review · 2020-07 · Blockchain) — https://trailofbits.com/library/mykey/
- Symbol (Security review · NEM Group · 2020-07 · Blockchain) — https://trailofbits.com/library/symbol/
- Ledger Filecoin (Security review · Protocol Labs · 2020-07 · Blockchain) — https://trailofbits.com/library/ledger-filecoin/
- Epicenter 346 (Podcast · 2020-06) — https://trailofbits.com/library/epicenter-346/
- Hey.com (Security review · Basecamp · 2020-06 · AppSec) — https://trailofbits.com/library/hey-com/
- Azure Sphere (Security review · 2020-06 · AppSec) — https://trailofbits.com/library/azure-sphere/
- Magma (Security review · Tezos · 2020-06 · Blockchain) — https://trailofbits.com/library/magma/
- Matic (Security review · 2020-06 · Blockchain) — https://trailofbits.com/library/matic/
- Lighthouse (Security review · 2020-06 · Blockchain) — https://trailofbits.com/library/lighthouse/
- Dexter (Security review · Dexter · 2020-06 · Blockchain) — https://trailofbits.com/library/dexter/
- Chainlink (Security review · 2020-06 · Blockchain) — https://trailofbits.com/library/chainlink/
- Absolute AppSec 97 (Podcast · 2020-05) — https://trailofbits.com/library/absolute-appsec-97/
- Unchained 170 (Podcast · 2020-05) — https://trailofbits.com/library/unchained-170/
- Zoom (Security review · 2020-05 · AppSec) — https://trailofbits.com/library/zoom/
- tBTC (Security review · Ethereum/EVM · 2020-05 · Blockchain) — https://trailofbits.com/library/tbtc/
- Chainlink Flux (Security review · 2020-05 · Blockchain) — https://trailofbits.com/library/chainlink-flux/
- Risky Biz 580 (Podcast · 2020-04) — https://trailofbits.com/library/risky-biz-580/
- Absolute AppSec 91 (Podcast · 2020-04) — https://trailofbits.com/library/absolute-appsec-91/
- Secure Transport (Security review · Western Digital · 2020-04 · AppSec) — https://trailofbits.com/library/western-digital-secure-transport/
- Secure Transport (Security review · 2020-04 · AppSec) — https://trailofbits.com/library/secure-transport/
- Zcash (Security review · Electric Coin Co · 2020-04 · Blockchain) — https://trailofbits.com/library/zcash/
- QTUM (Security review · Ethereum/EVM · 2020-04 · Blockchain) — https://trailofbits.com/library/qtum/
- Hegic (Security review · Hegic · 2020-04 · Blockchain) — https://trailofbits.com/library/hegic/
- Zero Knowledge 122 (Podcast · 2020-03 · Crypto) — https://trailofbits.com/library/zero-knowledge-122/
- Standard Notes (Security review · Standard Notes · 2020-03 · Crypto) — https://trailofbits.com/library/standard-notes/
- ZeroTier 2.0 (Security review · ZeroTier, Inc · 2020-03 · AppSec) — https://trailofbits.com/library/zerotier-2-0/
- Terraform (Security review · 2020-03 · Supply Chain) — https://trailofbits.com/library/terraform/
- OPA (Security review · 2020-03 · Supply Chain) — https://trailofbits.com/library/opa/
- Golem Network (Security review · 2020-03 · Blockchain) — https://trailofbits.com/library/golem-network/
- Reddit (Security review · 2020-03 · Blockchain) — https://trailofbits.com/library/reddit/
- Elrond (Security review · 2020-03 · Blockchain) — https://trailofbits.com/library/elrond/
- Voatz (Security review · Multiple · 2020-02 · AppSec) — https://trailofbits.com/library/voatz/
- Vault (Security review · 2020-02 · AppSec) — https://trailofbits.com/library/vault/
- Chai (Security review · Ethereum/EVM · 2020-02 · Blockchain) — https://trailofbits.com/library/chai/
- Compound (Security review · Ethereum/EVM · 2020-02 · Blockchain) — https://trailofbits.com/library/compound/
- Echidna: effective, usable, and fast fuzzing for smart contracts (Academic paper · 2020 · Systems) — https://trailofbits.com/library/echidna-effective-usable-and-fast-fuzzing-for-smart-contracts/
- ICARUS: Understanding De Facto Formats By Way of Feathers and Wax (Academic paper · 2020) — https://trailofbits.com/library/icarus-understanding-de-facto-formats-by-way-of-feathers-and-wax/
- Toward Automated Grammar Extraction via Semantic Labeling of Parser Implementations (Academic paper · 2020) — https://trailofbits.com/library/toward-automated-grammar-extraction-via-semantic-labeling-of-parser-im/
- What are the Actual Flaws in Important Smart Contracts? (Academic paper · 2020) — https://trailofbits.com/library/what-are-the-actual-flaws-in-important-smart-contracts/
- Echidna: A Practical Smart Contract Fuzzer (Academic paper · 2020) — https://trailofbits.com/library/echidna-a-practical-smart-contract-fuzzer/
- How to find bugs when (ground) truth isn't real (Conference talk · 2020 · Systems) — https://trailofbits.com/library/how-to-find-bugs-when-ground-truth-isn-t-real/
- Toward Automated Grammar Extraction via Semantic Labeling of Parser Implementations (Conference talk · 2020 · Systems) — https://trailofbits.com/library/toward-automated-grammar-extraction-via-semantic-labeling-of-parser-im-2020/
- Detecting transaction replacement attacks with Manticore (Conference talk · 2020 · Blockchain) — https://trailofbits.com/library/detecting-transaction-replacement-attacks-with-manticore/
- DeFi Hacks and Future Threats: The Role of Economics in Secure Protocol Design (Conference talk · 2020 · Blockchain) — https://trailofbits.com/library/defi-hacks-and-future-threats-the-role-of-economics-in-secure-protocol/
- PrivacyRaven: Comprehensive Privacy Testing for Deep Learning (Conference talk · 2020 · AI/ML) — https://trailofbits.com/library/privacyraven-comprehensive-privacy-testing-for-deep-learning/
- Changelog (Podcast · 2020-01) — https://trailofbits.com/library/changelog/
- Western Digital Sweet B (Security review · Western Digital · 2020-01 · AppSec) — https://trailofbits.com/library/western-digital-sweet-b/
- Voice (Security review · 2020-01 · AppSec) — https://trailofbits.com/library/voice/
- etcd (Security review · Linux Foundation · 2020-01 · Supply Chain) — https://trailofbits.com/library/etcd/
- WorkLock (Security review · NuCypher · 2020-01 · Blockchain) — https://trailofbits.com/library/worklock/
- Balancer (Security review · Balancer · 2020-01 · Blockchain) — https://trailofbits.com/library/balancer/
- Curve.fi (Security review · Swiss Stake · 2020-01 · Blockchain) — https://trailofbits.com/library/curve-fi/
- EOSIO SDK (Security review · 2020-01 · Blockchain) — https://trailofbits.com/library/eosio-sdk/
- Breaking Aave Upgradeability (Disclosure · Aave · 2020 · Blockchain) — https://trailofbits.com/library/aave-v1-v2-breaking-aave-upgradeability/
- Accidentally stepping on a DeFi lego (Disclosure · yVault (yEarn) · 2020) — https://trailofbits.com/library/yvault-yearn-accidentally-stepping-on-a-defi-lego/
- Smart contract vulnerabilities due to Tezos message passing architecture (Disclosure · Tezos · 2020 · Blockchain) — https://trailofbits.com/library/smart-contract-vulnerabilities-due-to-tezos-message-passing-architectu/
- Bug Hunting with Crytic (Disclosure · Multiple · 2020) — https://trailofbits.com/library/e-y-nightfall-defistrategies-set-protocol-computable-aragon-balancer-b/
- Rook (Security review · Rook · 2019-12 · Supply Chain) — https://trailofbits.com/library/rook/
- Pixel (Security review · 2019-12 · Blockchain) — https://trailofbits.com/library/pixel/
- Zcash (Security review · Electric Coin Co · 2019-11 · Blockchain) — https://trailofbits.com/library/zcash-2019/
- Zcash (Security review · Electric Coin Co · 2019-11 · Blockchain) — https://trailofbits.com/library/zcash-2/
- Paymail Protocol (Security review · 2019-11 · Blockchain) — https://trailofbits.com/library/paymail-protocol/
- NEAR Protocol (Security review · 2019-11 · Blockchain) — https://trailofbits.com/library/near-protocol/
- Risky Business 559 (Podcast · 2019-10) — https://trailofbits.com/library/risky-business-559/
- Dharma Wallet (Security review · Dharma Labs · 2019-10 · Blockchain) — https://trailofbits.com/library/dharma-wallet/
- Simple Ledger (Security review · 2019-10 · Blockchain) — https://trailofbits.com/library/simple-ledger/
- Livepeer (Security review · 2019-10 · Blockchain) — https://trailofbits.com/library/livepeer/
- Topo Finance (Security review · 2019-10 · Blockchain) — https://trailofbits.com/library/topo-finance/
- 0x Protocol (Security review · 0x Protocol · 2019-10 · Blockchain) — https://trailofbits.com/library/0x-protocol/
- EOSIO 2.0 (Security review · 2019-10 · Blockchain) — https://trailofbits.com/library/eosio-2-0/
- Status-go (Security review · 2019-10 · Blockchain) — https://trailofbits.com/library/status-go/
- Smart Contract Security Automation (Workshop · 2019-10) — https://trailofbits.com/library/smart-contract-security-automation/
- FOSS Weekly 545 (Podcast · 2019-09) — https://trailofbits.com/library/foss-weekly-545/
- Flexa (Security review · Flexa · 2019-09 · Blockchain) — https://trailofbits.com/library/flexa/
- AZTEC Protocol (Security review · AZTEC · 2019-09 · Blockchain) — https://trailofbits.com/library/aztec-protocol/
- Oasis Labs (Security review · 2019-09 · Blockchain) — https://trailofbits.com/library/oasis-labs/
- Aave Protocol (Security review · Aave · 2019-09 · Blockchain) — https://trailofbits.com/library/aave-protocol/
- Celo (Security review · 2019-09 · Blockchain) — https://trailofbits.com/library/celo/
- Podcast.init 225 (Podcast · 2019-08) — https://trailofbits.com/library/podcast-init-225/
- Absolute AppSec 68 (Podcast · 2019-08) — https://trailofbits.com/library/absolute-appsec-68/
- MC Dai (Security review · Ethereum/EVM · 2019-08 · Blockchain) — https://trailofbits.com/library/mc-dai-2019/
- Staked (Security review · 2019-08 · Blockchain) — https://trailofbits.com/library/staked/
- Compound (Security review · Ethereum/EVM · 2019-08 · Blockchain) — https://trailofbits.com/library/compound-2019/
- Parity Fether (Security review · 2019-08 · Blockchain) — https://trailofbits.com/library/parity-fether/
- Blockchain.com (Security review · 2019-08 · Blockchain) — https://trailofbits.com/library/blockchain-com/
- Smart Contract Audit Findings (Dataset · 2019-08) — https://trailofbits.com/library/smart-contract-audit-findings/
- Hashing it Out 53 (Podcast · 2019-07) — https://trailofbits.com/library/hashing-it-out-53/
- Computable (Security review · Computable · 2019-07 · Blockchain) — https://trailofbits.com/library/computable/
- Azure Sphere (Security review · 2019-06 · AppSec) — https://trailofbits.com/library/azure-sphere-2019/
- RandomX (Security review · Arweave · 2019-06 · Blockchain) — https://trailofbits.com/library/randomx/
- Absolute AppSec 60 (Podcast · 2019-05) — https://trailofbits.com/library/absolute-appsec-60/
- SanDisk X600 (Security review · Western Digital · 2019-05 · AppSec) — https://trailofbits.com/library/western-digital-sandisk-x600/
- Kubernetes (Security review · 2019-05 · Supply Chain) — https://trailofbits.com/library/kubernetes/
- Numerai (Security review · Numerai · 2019-05 · Blockchain) — https://trailofbits.com/library/numerai/
- MerkleX (Security review · 2019-05 · Blockchain) — https://trailofbits.com/library/merklex/
- TokenCard (Security review · TokenCard · 2019-05 · Blockchain) — https://trailofbits.com/library/tokencard/
- Interest Token (Security review · 2019-05 · Blockchain) — https://trailofbits.com/library/interest-token/
- Loom (Security review · 2019-05 · Blockchain) — https://trailofbits.com/library/loom/
- Absolute AppSec 55 (Podcast · 2019-04) — https://trailofbits.com/library/absolute-appsec-55/
- ZecWallet (Security review · ZecWallet · 2019-04 · Blockchain) — https://trailofbits.com/library/zecwallet/
- Unity Coin (Security review · 2019-04 · Blockchain) — https://trailofbits.com/library/unity-coin/
- Compound (Security review · Ethereum/EVM · 2019-04 · Blockchain) — https://trailofbits.com/library/compound-2/
- Reserve Protocol (Security review · Reserve Protocol · 2019-03 · Blockchain) — https://trailofbits.com/library/reserve-protocol-2019/
- Algorand (Security review · 2019-03 · Blockchain) — https://trailofbits.com/library/algorand/
- Ocean Protocol (Security review · 2019-03 · Blockchain) — https://trailofbits.com/library/ocean-protocol/
- UMA Project (Security review · 2019-03 · Blockchain) — https://trailofbits.com/library/uma-project/
- Centrifuge (Security review · 2019-03 · Blockchain) — https://trailofbits.com/library/centrifuge/
- Nomisma (Security review · 2019-03 · Blockchain) — https://trailofbits.com/library/nomisma/
- Set Protocol (Security review · Set Protocol · 2019-03 · Blockchain) — https://trailofbits.com/library/set-protocol/
- Tendermint (Security review · 2019-03 · Blockchain) — https://trailofbits.com/library/tendermint/
- NuCypher (Security review · NuCypher · 2019-02 · Blockchain) — https://trailofbits.com/library/nucypher/
- Manticore: Symbolic Execution for Binaries and Smart Contracts (Academic paper · 2019 · Systems) — https://trailofbits.com/library/manticore-symbolic-execution-for-binaries-and-smart-contracts/
- Slither: A Static Analysis Framework For Smart Contracts (Academic paper · 2019) — https://trailofbits.com/library/slither-a-static-analysis-framework-for-smart-contracts/
- The Treachery of Files and Two New Tools that Tame It (Conference talk · 2019 · Systems) — https://trailofbits.com/library/the-treachery-of-files-and-two-new-tools-that-tame-it/
- Symbolically Executing a Fuzzy Tyrant (Conference talk · 2019 · Systems) — https://trailofbits.com/library/symbolically-executing-a-fuzzy-tyrant/
- Kernel space fault injection with KRF (Conference talk · 2019 · Systems) — https://trailofbits.com/library/kernel-space-fault-injection-with-krf/
- Binary Symbolic Execution With KLEE-Native (Conference talk · 2019 · Systems) — https://trailofbits.com/library/binary-symbolic-execution-with-klee-native/
- Going sicko mode on the Linux Kernel (Conference talk · 2019 · Systems) — https://trailofbits.com/library/going-sicko-mode-on-the-linux-kernel/
- Fantastic Bugs and How to Squash Them; or, the Crimes of Solidity (Conference talk · 2019 · Blockchain) — https://trailofbits.com/library/fantastic-bugs-and-how-to-squash-them-or-the-crimes-of-solidity/
- SlithIR: High-Precision Security Analysis with an IR for Solidity (Conference talk · 2019 · Blockchain) — https://trailofbits.com/library/slithir-high-precision-security-analysis-with-an-ir-for-solidity/
- Slither: A Static Analysis Framework for Smart Contracts (Conference talk · 2019 · Blockchain) — https://trailofbits.com/library/slither-a-static-analysis-framework-for-smart-contracts-2019/
- What blockchain got right (Conference talk · 2019 · Blockchain) — https://trailofbits.com/library/what-blockchain-got-right/
- Traditional Infosec for Blockchain Firms (Conference talk · 2019 · Blockchain) — https://trailofbits.com/library/traditional-infosec-for-blockchain-firms/
- Seriously, stop using RSA (Conference talk · 2019 · Crypto) — https://trailofbits.com/library/seriously-stop-using-rsa/
- Best Practices for Cryptography in Python (Conference talk · 2019 · Crypto) — https://trailofbits.com/library/best-practices-for-cryptography-in-python/
- Evidence-driven Security Engineering (Conference talk · 2019 · Systems) — https://trailofbits.com/library/evidence-driven-security-engineering/
- Linux Security Event Monitoring with osquery (Conference talk · 2019 · Systems) — https://trailofbits.com/library/linux-security-event-monitoring-with-osquery/
- osql: The community oriented osquery fork (Conference talk · 2019 · Systems) — https://trailofbits.com/library/osql-the-community-oriented-osquery-fork/
- Return to the 100 Acre Woods (Conference talk · 2019 · Systems) — https://trailofbits.com/library/return-to-the-100-acre-woods/
- Swimming with the kubectl fish (Conference talk · 2019 · Systems) — https://trailofbits.com/library/swimming-with-the-kubectl-fish/
- Python internals - let's talk about dicts (Conference talk · 2019 · Systems) — https://trailofbits.com/library/python-internals-let-s-talk-about-dicts/
- Improving PyPI's security with Two Factor Authentication (Conference talk · 2019 · Supply Chain) — https://trailofbits.com/library/improving-pypi-s-security-with-two-factor-authentication/
- Peeling back the 'Shlayers' of macOS Malware (Conference talk · 2019 · Systems) — https://trailofbits.com/library/peeling-back-the-shlayers-of-macos-malware/
- Hashing it Out 35 (Podcast · 2019-01) — https://trailofbits.com/library/hashing-it-out-35/
- Risky Biz 526 (Podcast · 2019-01) — https://trailofbits.com/library/risky-biz-526/
- AMP StableWire (Security review · 2019-01 · Blockchain) — https://trailofbits.com/library/amp-stablewire/
- EIP-1283 (Security review · Ethereum/EVM · 2019-01 · Blockchain) — https://trailofbits.com/library/eip-1283/
- Absolute AppSec 37 (Podcast · 2018-11) — https://trailofbits.com/library/absolute-appsec-37/
- Bitcoin SV (Security review · 2018-11 · Blockchain) — https://trailofbits.com/library/bitcoin-sv-2018/
- Ampleforth (Security review · Ampleforth · 2018-11 · Blockchain) — https://trailofbits.com/library/ampleforth/
- Origin Protocol (Security review · Origin Protocol · 2018-11 · Blockchain) — https://trailofbits.com/library/origin-protocol/
- ndau (Security review · 2018-11 · Blockchain) — https://trailofbits.com/library/ndau/
- Introduction to Smart Contract Exploitation (Workshop · 2018-11) — https://trailofbits.com/library/introduction-to-smart-contract-exploitation/
- Manticore EVM Workshop (Workshop · 2018-11 · Blockchain) — https://trailofbits.com/library/manticore-evm-workshop/
- Absolute AppSec 34 (Podcast · 2018-10) — https://trailofbits.com/library/absolute-appsec-34/
- Paxos Standard (Security review · Paxos · 2018-10 · Blockchain) — https://trailofbits.com/library/paxos-standard/
- Basecoin (Security review · Intangible Labs · 2018-10 · Blockchain) — https://trailofbits.com/library/basecoin/
- Pantheon (Security review · Ethereum/EVM · 2018-10 · Blockchain) — https://trailofbits.com/library/pantheon/
- Smart Contract Security Automation (Workshop · 2018-10) — https://trailofbits.com/library/smart-contract-security-automation-2018/
- DeepState: Bringing Vulnerability Detection Tools into the Dev Cycle (Workshop · 2018-10) — https://trailofbits.com/library/deepstate-bringing-vulnerability-detection-tools-into-the-dev-cycle/
- Compound (Security review · 2018-09 · Blockchain) — https://trailofbits.com/library/compound-2018/
- Smart Contract Security Automation (Workshop · 2018-09) — https://trailofbits.com/library/smart-contract-security-automation-2/
- Risky Biz 510 (Podcast · 2018-08) — https://trailofbits.com/library/risky-biz-510/
- The Smartest Contract 15 (Podcast · 2018-08) — https://trailofbits.com/library/the-smartest-contract-15/
- Project Callisto (Security review · 2018-08 · Crypto) — https://trailofbits.com/library/project-callisto/
- NuCypher (Security review · NuCypher · 2018-08 · Blockchain) — https://trailofbits.com/library/nucypher-2018/
- Building Blocks (Security review · 2018-08 · Blockchain) — https://trailofbits.com/library/building-blocks/
- CENTRE (Security review · 2018-07 · Blockchain) — https://trailofbits.com/library/centre/
- Bloom (Security review · 2018-07 · Blockchain) — https://trailofbits.com/library/bloom/
- Parity (Security review · Parity Technologies · 2018-07 · Blockchain) — https://trailofbits.com/library/parity/
- Tezori (Security review · 2018-07 · Blockchain) — https://trailofbits.com/library/tezori/
- Gemini Dollar (Security review · Gemini · 2018-06 · Blockchain) — https://trailofbits.com/library/gemini-dollar/
- Dharma (Security review · 2018-05 · Blockchain) — https://trailofbits.com/library/dharma/
- Golem (Security review · Golem · 2018-04 · Blockchain) — https://trailofbits.com/library/golem/
- Zero Knowledge 16 (Podcast · 2018-03 · Crypto) — https://trailofbits.com/library/zero-knowledge-16/
- Web3 (Security review · Wallet Reviews · 2018-03 · Blockchain) — https://trailofbits.com/library/web3/
- LivePeer (Security review · Livepeer · 2018-03 · Blockchain) — https://trailofbits.com/library/livepeer-2018/
- Manticore EVM Workshop (Workshop · 2018-03 · Blockchain) — https://trailofbits.com/library/manticore-evm-workshop-2018/
- Risky Biz 488 (Podcast · 2018-02) — https://trailofbits.com/library/risky-biz-488/
- Toward Smarter Vulnerability Discovery Using Machine Learning (Academic paper · 2018 · AI/ML) — https://trailofbits.com/library/toward-smarter-vulnerability-discovery-using-machine-learning/
- The Past, Present, and Future of Cyberdyne (Academic paper · 2018) — https://trailofbits.com/library/the-past-present-and-future-of-cyberdyne/
- DeepState - Symbolic Unit Testing for C and C++ (Academic paper · 2018) — https://trailofbits.com/library/deepstate-symbolic-unit-testing-for-c-and-c/
- Vulnerability Modeling with Binary Ninja (Conference talk · 2018 · Systems) — https://trailofbits.com/library/vulnerability-modeling-with-binary-ninja/
- Property-testing of smart contracts (Conference talk · 2018 · Blockchain) — https://trailofbits.com/library/property-testing-of-smart-contracts/
- Anatomy of an unsafe programming language (Conference talk · 2018 · Blockchain) — https://trailofbits.com/library/anatomy-of-an-unsafe-programming-language/
- Contract upgrade risks and recommendations (Conference talk · 2018 · Blockchain) — https://trailofbits.com/library/contract-upgrade-risks-and-recommendations/
- Blackhat Ethereum (Conference talk · 2018 · Blockchain) — https://trailofbits.com/library/blackhat-ethereum/
- Blockchain Autopsies - Analyzing Smart Contract Deaths (Conference talk · 2018 · Blockchain) — https://trailofbits.com/library/blockchain-autopsies-analyzing-smart-contract-deaths/
- Rattle - an Ethereum EVM binary analysis framework (Conference talk · 2018 · Blockchain) — https://trailofbits.com/library/rattle-an-ethereum-evm-binary-analysis-framework/
- Securing value on the Ethereum blockchain (Conference talk · 2018 · Blockchain) — https://trailofbits.com/library/securing-value-on-the-ethereum-blockchain/
- Binary analysis, meet the blockchain (Conference talk · 2018 · Blockchain) — https://trailofbits.com/library/binary-analysis-meet-the-blockchain/
- Getting started with osquery (Conference talk · 2018 · Systems) — https://trailofbits.com/library/getting-started-with-osquery/
- osquery Super Features (Conference talk · 2018 · Systems) — https://trailofbits.com/library/osquery-super-features/
- osquery Extension Skunkworks (Conference talk · 2018 · Systems) — https://trailofbits.com/library/osquery-extension-skunkworks/
- Low-level debugging with Pwndbg (Conference talk · 2018 · Systems) — https://trailofbits.com/library/low-level-debugging-with-pwndbg/
- Insecure Things to Avoid in Python (Conference talk · 2018 · Systems) — https://trailofbits.com/library/insecure-things-to-avoid-in-python/
- DappHub (Security review · DappHub · 2017-12 · Blockchain) — https://trailofbits.com/library/dapphub/
- RSKj (Security review · RSK · 2017-11 · Blockchain) — https://trailofbits.com/library/rskj/
- Risky Biz 474 (Podcast · 2017-10) — https://trailofbits.com/library/risky-biz-474/
- MakerDAO Sai (Security review · DappHub · 2017-10 · Blockchain) — https://trailofbits.com/library/makerdao-sai/
- Manticore Workshop (Workshop · 2017-10) — https://trailofbits.com/library/manticore-workshop/
- Omega One (Security review · 2017-08 · Blockchain) — https://trailofbits.com/library/omega-one/
- Georgian Partners 47 (Podcast · 2017-05) — https://trailofbits.com/library/georgian-partners-47/
- VUC 643 (Podcast · 2017-04) — https://trailofbits.com/library/vuc-643/
- Risky Biz 449 (Podcast · 2017-03) — https://trailofbits.com/library/risky-biz-449/
- File Polyglottery; or, This PoC is also a picture of cats (Conference talk · 2017 · Systems) — https://trailofbits.com/library/file-polyglottery-or-this-poc-is-also-a-picture-of-cats/
- Be a binary rockstar (Conference talk · 2017 · Systems) — https://trailofbits.com/library/be-a-binary-rockstar/
- Symbolic Execution for Humans (Conference talk · 2017 · Systems) — https://trailofbits.com/library/symbolic-execution-for-humans/
- The spirit of the 90s is still alive in Brooklyn (Conference talk · 2017 · Systems) — https://trailofbits.com/library/the-spirit-of-the-90s-is-still-alive-in-brooklyn/
- Automatic bug finding for the blockchain (Conference talk · 2017 · Blockchain) — https://trailofbits.com/library/automatic-bug-finding-for-the-blockchain/
- The Joy of Pwning (Conference talk · 2017 · Systems) — https://trailofbits.com/library/the-joy-of-pwning/
- Risky Biz 425 (Podcast · 2016-09) — https://trailofbits.com/library/risky-biz-425/
- zlib (Security review · zlib · 2016-09 · AppSec) — https://trailofbits.com/library/zlib/
- Risky Biz 421 (Podcast · 2016-08) — https://trailofbits.com/library/risky-biz-421/
- Risky Biz 416 (Podcast · 2016-07) — https://trailofbits.com/library/risky-biz-416/
- Risky Biz 399 (Podcast · 2016-02) — https://trailofbits.com/library/risky-biz-399/
- The dream of a static and dynamic analysis shootout (Conference talk · 2016 · Systems) — https://trailofbits.com/library/the-dream-of-a-static-and-dynamic-analysis-shootout/
- Binary constraint solving for automatic exploit generation (Conference talk · 2016 · Systems) — https://trailofbits.com/library/binary-constraint-solving-for-automatic-exploit-generation/
- The Smart Fuzzer Revolution (Conference talk · 2016 · Systems) — https://trailofbits.com/library/the-smart-fuzzer-revolution/
- Making a scaleable automated hacking system (Conference talk · 2016 · Systems) — https://trailofbits.com/library/making-a-scaleable-automated-hacking-system/
- Cyberdyne - Automatic bug-finding at scale (Conference talk · 2016 · Systems) — https://trailofbits.com/library/cyberdyne-automatic-bug-finding-at-scale/
- Swift Reversing (Conference talk · 2016 · AppSec) — https://trailofbits.com/library/swift-reversing/
- Modern iOS Application Security (Conference talk · 2016 · AppSec) — https://trailofbits.com/library/modern-ios-application-security/
- OSX slack:// protocol handler javascript injection (Disclosure · Slack · 2016) — https://trailofbits.com/library/osx-slack-protocol-handler-javascript-injection/
- Regulation of Intrusion and Surveillance Software (Policy comment · Commerce Dept · 2015-07) — https://trailofbits.com/library/commerce-dept-regulation-of-intrusion-and-surveillance-software/
- Risky Biz 348 (Podcast · 2015-06) — https://trailofbits.com/library/risky-biz-348/
- Risky Biz 370 (Podcast · 2015-02) — https://trailofbits.com/library/risky-biz-370/
- Cyber-Deception and Attribution in Capture-the-Flag Exercises (Academic paper · 2015) — https://trailofbits.com/library/cyber-deception-and-attribution-in-capture-the-flag-exercises/
- Hardware side channels in virtualized environments (Conference talk · 2015 · Systems) — https://trailofbits.com/library/hardware-side-channels-in-virtualized-environments/
- Exploiting Out-of-Order Execution (Conference talk · 2015 · Systems) — https://trailofbits.com/library/exploiting-out-of-order-execution/
- Double free in VLC's 3GP file format (Disclosure · VLC · 2015) — https://trailofbits.com/library/double-free-in-vlc-s-3gp-file-format/
- McSema: Static translation of x86 to LLVM IR (Conference talk · 2014 · Systems) — https://trailofbits.com/library/mcsema-static-translation-of-x86-to-llvm-ir/
- Build it Break it Fix it (Conference talk · 2014 · Systems) — https://trailofbits.com/library/build-it-break-it-fix-it/
- How to CTF - Getting and using Other People's Computers (OPC) (Conference talk · 2014 · Systems) — https://trailofbits.com/library/how-to-ctf-getting-and-using-other-people-s-computers-opc/
- Low-level Security (Conference talk · 2014 · Systems) — https://trailofbits.com/library/low-level-security/
- Security and Your Business (Conference talk · 2014 · Systems) — https://trailofbits.com/library/security-and-your-business/
- Bringing nothing to the party (Conference talk · 2013 · Systems) — https://trailofbits.com/library/bringing-nothing-to-the-party/
- The Exploit Intelligence Project Revisited (Conference talk · 2013 · Systems) — https://trailofbits.com/library/the-exploit-intelligence-project-revisited/
- Analyzing the MD5 collision in Flame (Conference talk · 2012 · Crypto) — https://trailofbits.com/library/analyzing-the-md5-collision-in-flame/
- From One Ivory Tower to Another (Conference talk · 2012 · Systems) — https://trailofbits.com/library/from-one-ivory-tower-to-another/
- The Mobile Exploit Intelligence Project (Conference talk · 2012 · AppSec) — https://trailofbits.com/library/the-mobile-exploit-intelligence-project/
- A Tale of Mobile Threats (Conference talk · 2012 · AppSec) — https://trailofbits.com/library/a-tale-of-mobile-threats/
- AI Safety & Security Training (Service overview · —) — https://trailofbits.com/library/ai-safety-security-training/
- Building Secure Smart Contracts (Guide / handbook · —) — https://trailofbits.com/library/building-secure-smart-contracts/
- CTF Field Guide (Guide / handbook · —) — https://trailofbits.com/library/ctf-field-guide/
- RSA GTFO (Academic paper · —) — https://trailofbits.com/library/rsa-gtfo/
- Ruby Security Field Guide (Guide / handbook · —) — https://trailofbits.com/library/ruby-security-field-guide/
- Testing Handbook (Guide / handbook · —) — https://trailofbits.com/library/testing-handbook/
- ZKDocs (Guide / handbook · —) — https://trailofbits.com/library/zkdocs/