How Centrifuge routes messages between chains - per-pool adapter sets, an n-of-m vote counter that tolerates duplicates, transient batching, gas subsidies, and the recovery paths.
2026, Aug 18 — 22 minute read
What STM32L4 readout protection, write protection, the hardware firewall, PCROP, OTP and flash ECC actually do, how a shipping product combines them, and where each one stops helping.
2026, Jul 31 — 18 minute read
How hardware wallets handle an attacker who has both the device and the user - duress PINs, decoy wallets, delta mode, passive wipe triggers - and where each defence stops working.
2026, Jul 31 — 17 minute read
A signed firmware binary proves who built it, not what it was built from. How reproducible builds, deterministic toolchains and on-device signature checks close that gap, using the COLDCARD firmware as a worked example.
2026, Jul 31 — 15 minute read
A structured OWASP threat model for cross-chain bridges, built from the Ronin 2022, Poly Network 2023, Ronin 2024 and Kelp DAO 2026 incidents, covering assets, trust boundaries, STRIDE analysis, an attack tree and a prioritised threat register.
2026, Jul 31 — 29 minute read
A comparative analysis of ten major cross-chain bridge exploits between 2021 and 2026, grouped into five failure classes, covering the architecture of each bridge, the root cause of each failure, and the destination of the stolen funds.
2026, Jul 31 — 41 minute read
A wallet firmware generated seeds with far less entropy than intended because a linker resolved rng_get() to a software PRNG. How the defect worked, why XOR whitening hid it, and what catches this class of bug.
2026, Jul 31 — 17 minute read
