Research

Every reading published here, newest first. Each one says what it read, what it did not, and where to replay it.

Lido on BNB Chain: who can change what verifies a bridge message

2026-10-14
Scope
The bridges that carry Lido's token to BNB Chain, read directly on the chains at the blocks the page gives.
What it reads
What verifies a message today on each route, who can change it, with what delay, and the calls that replay each row.
What it does not read
The page lists what was not compared; it does not say any setting is wrong.
Read the page

Chain files: one page per chain

2026-10-14
Scope
Eight chains: Ethereum L1, Arbitrum, Base, Hyperliquid, Tempo, Robinhood Chain, Solana and Zcash.
What it reads
For each chain: the contracts the oracle tracks and their score bands, three findings that belong to that chain, each with the public calls that replay it, and the checks a reader can run in two minutes.
What it does not read
Each page lists what it does not read. The oracles run on testnets and no oracle is deployed on a mainnet.
Open the chain files

Aave V3 Core: levels 0-5 per privileged role

2026-10-13
Scope
25 of the 67 Core reserves, plus BTC.b and USDe, at block 26,184,127.
What it reads
The privileged roles of each reserve (proxy admin, owner, minter, pauser and similar), who holds each one, the threshold of a multisig and the delay of a timelock, with two negative witnesses run once for the whole pass.
What it does not read
40 reserves, Aragon ACLs, the freeze status of reserves; the RolesAuthority of PAXGy is read by hand, not by the script.
Read the detailRepository

Who executes a role: one measured case

2026-10-12
Scope
46 call forms probed on 14 AccessControl contracts, plus three contracts measured by hand and 26 Ownable owners on Ethereum.
What it reads
Each privileged call simulated from each role holder at a fixed block, to check that the holder shown is the one the contract lets act.
What it does not read
The accounts that act through signed orders, which a plain call does not exercise, and the functions that could not be named from the code.
Read the detail

Backtest: would the published requirements have flagged real incidents?

2026-10-12
Scope
55 incidents from public postmortems, 7 of them about who controls a contract.
What it reads
The six published authority requirements applied to the setup before each incident, as its write-up gives it.
What it does not read
No historical on-chain state was re-read: the setup before an incident comes from the write-up only.
Read the detailRepository

Neighbouring tools, one row each

2026-10-12
Scope
17 neighbouring tools and this one, read on 2026-10-12.
What it reads
What each tool's own pages say it reads, and what they say it does not.
What it does not read
Not checked with the tools' authors: a reading may be out of date or wrong, and corrections are welcome.
Read the detail

A reading is dated and does not change after the fact: a mistake is published as a correction next to it. Not an audit, not investment advice. Back to the dashboard.