Posts by Aron Turner | Blog

Posts by Aron TurnerClear filter

Top-down view of a steel desk tiled with identical teal access badges, where one slot holds a red-framed mirror reflecting the badges and bearing a teal approval stamp, as a gloved hand slides it into place

FlashLoopAdapter $305K: A Safe Module That Took the Caller's Word for It

A Safe module for looped Aave v3 positions asked its caller whether it was enabled, and believed the answer. A fake Safe said yes, and 114 ETH of equity left two real Safes in one transaction.

Aron Turner·Oct 8, 2026

Cutaway of a dark vault door showing seven key cylinders, three turned red and four teal, retracted bolts, a rack of teal allowlist cards with one new red card, and a gloved hand sliding ingots out through the open gap

exploits

Base wstETH Vault: $6M Drained Through a Whitelist Its Own 3-of-7 Safe Signed

Three valid Safe signatures whitelisted an attacker contract 85 minutes old. Six outflows later, 1,783 wstETH was gone, and 15 hours on, the Safe had sent no revocation.

Aron Turner·Oct 5, 2026

A dark teal vault tower rising into shadow, each floor's door fitted with its own lock, while red conduits from a rooftop lever held by a hooded figure run down the facade and bypass every lock.

exploits

Neutron's $9.4M Governance Takeover: How $20K of NTRN Bought Admin Over Astroport and Drop

An attacker bought 31.6M NTRN for $20,199 minutes before a vote closed, passed a proposal that made them admin of 10 Astroport and Drop contracts, and drained them in 24 minutes.

Aron Turner·Sep 24, 2026

Dark isometric illustration of a three-tier vault seen from a raised corner, the two upper tiers gutted with their cell doors swung open and studs dark behind a drawn roll-down shutter that stops above the packed teal lower tier, where one forced cell burns red with its trays pulled out

exploits

Notional Finance $1.73M Exploit: A Debt of 2^128 That Read as Zero

An attacker minted two fCash liabilities summing to exactly 2^128 against Notional's 2020-era V1 escrow. An unchecked uint128 downcast truncated the debt to zero, and the collateral check passed.

Aron Turner·Sep 10, 2026

Cutaway cross-section of a hardware wallet board: the hardware random number generator die sits dark with its bond wires ending at bare pads, while a small brass counter wheel is wired into its place and the seed register beside it stays mostly empty.

exploits

Coldcard's $88.6M Entropy Failure: Five Years of Guessable Bitcoin Seeds

A March 2021 build error routed Coldcard seed generation to a software PRNG instead of the hardware RNG. Five years later, attackers swept 1,367 BTC from 4,585 addresses without touching a device.

Aron Turner·Aug 3, 2026

Abstract illustration of a lending exploit: teal concentrated-liquidity bands meet a translucent vault of stacked cells, and red value drains through the misaligned seam where the two accounting systems meet, over dark circuitry.

exploits

DefiTuna Exploit: $580K Drained From Solana Lending Pool

DefiTuna's USDC lending pool lost $580K to a July 2026 exploit on Solana, leaving it in bad debt. Inside the attack, the Sec3 audit gap, and the lessons.

Aron Turner·Jul 20, 2026

FlashLoopAdapter $305K: A Safe Module That Took the Caller's Word for It

Base wstETH Vault: $6M Drained Through a Whitelist Its Own 3-of-7 Safe Signed

Neutron's $9.4M Governance Takeover: How $20K of NTRN Bought Admin Over Astroport and Drop

Notional Finance $1.73M Exploit: A Debt of 2^128 That Read as Zero

Coldcard's $88.6M Entropy Failure: Five Years of Guessable Bitcoin Seeds

DefiTuna Exploit: $580K Drained From Solana Lending Pool

JaredFromSubway MEV Bot Drained for $7.5M in a Counter-MEV Honeypot

The $3.2M SquidRouterModule Exploit: How a Public String Drained 86 Safe Wallets

GitHub's 3,800-Repo Breach: How a Poisoned VS Code Extension Burned the World's Biggest Code Host

Kelp DAO's $292M Hack and Aave's $6B Fallout: One Config Parameter Broke DeFi

Drift Protocol's $270M Exploit: How Solana's Durable Nonces Became a Social Engineering Weapon

What Does a Smart Contract Audit Actually Cost in 2026

Aave's $27M Liquidation Incident: How a Stale Oracle Parameter Wiped Out 34 Users

What to Expect From a Smart Contract Audit Report

AI's Growing Role in Auditing and Cybersecurity