Field Reports

Proof, NotPromises

Technical write-ups from real engagements. No sanitised summaries — problem, approach, execution, and measurable impact.

Smart Contract Audit

Critical Reentrancy Chain in a $40M DeFi Lending Protocol

How a multi-contract reentrancy path bypassed two existing audit reports and would have drained the protocol's entire liquidity reserve.

$40M

TVL Protected

Critical Findings

Total Issues

72h

Full Report Delivered

Engagement Breakdown

01 — Problem

The protocol had undergone two prior audits from well-known firms. Yet our pre-launch engagement was requested after an internal engineer noticed an unusual state ordering pattern in the collateral liquidation path. The client had $40M in locked liquidity preparing to go live on mainnet.

02 — Approach

We applied a three-track methodology: (1) automated scanning with Slither and Echidna fuzzing, (2) manual trace of every external call within the liquidation, borrow, and repay execution paths, and (3) formal modelling of the vault's state transitions using symbolic execution with Manticore. We paid specific attention to cross-contract interactions the previous audits had not modelled end-to-end.

03 — Technical Execution

We discovered a multi-hop reentrancy vector spanning three contracts: the Vault, the PriceOracle adapter, and an ERC-777 collateral token. During liquidation, the external call to the oracle's price feed triggered a callback into the Vault before balances were updated. An attacker could re-enter the liquidation function, drain the collateral reserve, and exit before the revert-on-underflow check fired. We built a full end-to-end exploit on a forked mainnet, draining 100% of available collateral in a single transaction.

04 — Impact

The vulnerability was remediated by introducing a re-entrancy guard and restructuring the state update order (checks-effects-interactions). Two additional high-severity issues — an unchecked return value on a fee transfer and a flash-loan-assisted oracle manipulation path — were patched before deployment. The protocol launched on schedule with zero post-deployment security incidents.

Tech Stack

SoliditySlitherEchidnaManticoreHardhatFoundryERC-777

Penetration Testing

BOLA Chain Leading to Full Tenant Data Exfiltration in a B2B SaaS Platform

An authorization logic flaw in a multi-tenant REST API allowed any authenticated user to read, modify, and delete records belonging to every other tenant.

14k

Tenants at Risk

Severity Classification

Time to Initial Finding

100%

Data Exposure Scope

Engagement Breakdown

01 — Problem

A fintech SaaS serving 14,000 business tenants engaged us for a black-box API penetration test ahead of their Series B security review. The only access provided was a standard business account with no elevated permissions.

02 — Approach

We followed a structured API recon process: mapping all endpoints from the JavaScript bundle, intercepting authenticated requests via Burp Suite, and systematically testing every object identifier for horizontal and vertical privilege escalation. We specifically targeted BOLA (Broken Object Level Authorization) across paginated list endpoints and resource-fetch calls.

03 — Technical Execution

Within four hours we identified that the `/api/v2/organizations/:id/invoices` endpoint performed no tenancy check beyond JWT signature validation. Substituting any valid `organization_id` returned that tenant's complete invoice history with full PII. Extending the test, we found the same pattern across `/contracts`, `/team-members`, and `/audit-logs`. A single PATCH request with a cross-tenant ID allowed us to modify another organization's billing settings. We documented a complete exfiltration script that iterated all 14,000 tenant IDs and recovered their data without triggering any rate-limiting or anomaly detection.

04 — Impact

The engineering team deployed a server-side tenancy middleware layer within 48 hours of receiving our report. All resource endpoints now enforce tenant context extracted from the authenticated JWT, verified independently of URL parameters. The fix was validated in a follow-up retest. The client passed their Series B security review two weeks later.

Tech Stack

REST APIBurp SuiteJWTOAuth 2.0PythonNode.js

Automation Engineering

From 3-Week Release Cycles to Sub-Hour Deployments for a 200-Engineer Org

Replacing a fragile Jenkins monolith with a fully automated, security-gated delivery platform across AWS, reducing deployment lead time by 97%.

97%

Lead Time Reduction

200+

Engineers Unblocked

Production Incidents Post-Migration

6wk

Full Migration Timeline

Engagement Breakdown

01 — Problem

A 200-person engineering organisation was operating on a three-week release cycle gated by a single Jenkins CI server maintained by one engineer. Deployments required manual SSH steps, had no rollback capability, and the average time from code-ready to production was 21 days. Developer frustration was high and the on-call rotation was burning the team out.

02 — Approach

We performed a current-state mapping of all 47 Jenkins jobs, catalogued every manual step and implicit knowledge dependency, then designed a replacement architecture on GitHub Actions with centralised reusable workflows. The migration was phased: non-critical services first, enabling us to iron out patterns before touching revenue-critical paths.

03 — Technical Execution

We engineered a shared GitHub Actions workflow library containing standardised stages: dependency installation, unit tests, SAST (Semgrep), SCA (OWASP Dependency-Check), container build + Trivy scan, Terraform plan/apply with OPA policy gating, and smoke-test verification. Each service team received a single `uses:` reference to the shared workflow. We built a progressive delivery layer on AWS CodeDeploy with automatic rollback triggers tied to CloudWatch error-rate alarms. Infrastructure was modularised into Terraform modules with state stored in S3 with DynamoDB locking.

04 — Impact

Deployment lead time dropped from 21 days to under 45 minutes. The Jenkins server was decommissioned. Security gates that previously required a separate manual checklist now ran automatically on every pull request. In the six months following migration, the team shipped 4× more features with zero P1 production incidents attributable to the deployment process.

Tech Stack

GitHub ActionsTerraformAWS ECSCodeDeployOPASemgrepTrivyCloudWatch

Want results like these for your organization?

Every engagement starts with a scoping call. We'll map your threat surface, agree on success criteria, and put it in writing before we start.

Start Your Engagement Explore Services