BitsLab
@0xbitslab

Securing and Building EMERGING Web3 Ecosystems 🛡️Sub-brand： @MoveBit_ | @ScaleBit_ | @TonBit_ 💡Bitslab AI Scanner：@BitslabAIOfc

bitslab.xyz/
Joined July 2024
118 Photos and videos
Article

When 1 Means Both 1 Wei and Token ID #1: Inside the OMNI404 Exploit

1. Background & Event Overview In the evolving landscape of Decentralized Finance (DeFi) and Non-Fungible Tokens (NFTs), hybrid token standards combining ERC-20 and ERC-721 functionality (such as
3
117
4,010
In BitsLab’s security analysis of cross-VM systems, precompiles, and native modules, this type of state mismatch is a key area of focus.
Article

One Balance Mismatch, 6 Chains Hit: Inside the $5.7M Cosmos EVM Exploit

Between August 20 and August 25, 2026, attackers exploited a balance-handling flaw in Cosmos EVM across multiple Cosmos-based networks. Cosmos Labs later confirmed that six networks were exploited.

6
1
93
15,055
How the $8.5M Term Finance Exploit Exposed a Governance Security Gap
Article

Beyond Smart Contract Bugs: How the $8.5M Term Finance Exploit Exposed a Governance Security Gap

Security incidents in DeFi are increasingly revealing a fundamental shift: the most dangerous vulnerabilities are not always hidden inside smart contract code. They often exist in the assumptions

2
2
4
2,510
Why upgrade permissions can be more dangerous than smart contract vulnerabilities?
Article

Your Smart Contract Has No Bug. Your Upgrade Authority Does.

In smart contract security, most discussions start with a familiar question: does the code contain vulnerabilities? Security teams spend significant effort analyzing reentrancy attacks, access control

2
3
5
2,456
Participating in a meeting could have exposed the Zoom client to remote attack?
Article

A Zoom Zero-Click RCE in 24 Hours: AI Is Changing the Exploit Timeline

For most users, joining a Zoom meeting would not normally be considered an attack surface. There is no need to open a suspicious attachment, click a link, or download a file. But a recently disclosed
2
4
4,207
Article

One Email Is All It Takes: How nanobot Becomes a Zero-Click Executor

Briefing As AI Agent frameworks scale into production, identity authentication and prompt injection are being chained together in increasingly subtle ways. During a code review of the open-source

5
5
8
425
Article

Balancer V2's Singleton Vault: 6 Design Tricks Worth Stealing

BitsLab Research · Balancer V2 Series (1/3) In 2020, while every other AMM was iterating on the "one contract per pool" model that Uniswap V2 popularized, Balancer made a counterintuitive call: put
1
83
Article

How a Single "|" Character Bypasses nanobot's Channel Authorization

TL;DR — BitsLab has disclosed the first security vulnerability identified in nanobot, an AI Agent framework. The flaw is a Channel-layer authorization bypass that requires only a single | character to
1
325
Article

Kelp DAO / KernelDAO rsETH Cross-Chain Security Incident Analysis Report

By BitsLab Security Research | 2026-04-20 —————————————————————— I. Incident Overview On 2026-04-18, a major security incident occurred on the rsETH cross-chain path operated by Kelp DAO / KernelDAO.
5
6
908
Article

Hyperbridge Exploited: 1B DOT Minted & Dumped in a Single Transaction

2026-04-13 | Security Incident Report by BitsLab On April 13, 2026, the Hyperbridge bridged DOT asset on Ethereum suffered a confirmed security exploit. The attacker forged a cross-chain message that
7
7
790
Article

BitsLab Select | Polymarket Arbitrage Analysis

Prediction markets are emerging as one of the most disruptive sectors in on-chain finance. As the largest decentralised prediction platform today, Polymarket's underlying arbitrage dynamics have
5
7
661
Article

BitsLab Deep Dive | Nanobot User Security Practice Guide

1. Introduction When an AI Agent possesses system-level capabilities such as shell execution, file read/write, network requests, and scheduled tasks, it is no longer just a "chatbot"—it is an operator
5
8
685
Load more