Options protocols rarely fail in one function. They fail when claims, collateral, expiry, vault accounting, hedging, and liquidation stop describing the same obligation. Our new article covers 8 vulnerability classes and the invariants that catch them.

What is your oracle agent doing off-chain, and what threatens it? LLMs can't reliably separate data from instructions, so they are easy to manipulate. Decentralisation helps with some threats: independent data sources, checks for hallucinations and freezes, and liveness across APIs. Against prompt injection, though, decentralisation alone doesn't do much. The attack can come through input data or memory poisoning. Injection in input data is often handled with a better prompt. That's not enough. Repeated, adaptive attempts can find a bypass. The stronger defence is in the architecture: the part that reads external content holds no keys or action tools. It only returns a proposed value. A deterministic service decides whether to sign without reading untrusted text. It checks range, deviation, data age, and independent reference data where available. The agent returns strict JSON: a proposed number or an alert. If something goes wrong, you must be able to trace why. Pin the model and prompt versions, set a low temperature, and log inputs, outputs, decisions, and memory changes. Commit log hashes on-chain if you need public tamper evidence. A quorum won't protect against shared model or infrastructure failures. Protect the control panel with MFA, separated permissions, and an audit log. Memory poisoning is sneakier. A poisoned record looks like the agent's own knowledge and can affect later steps, making the damage hard to trace. A study using ElizaOS found memory attacks significantly more effective than regular prompt injection in its tested setting. The prompt injection defences it tested offered limited protection. The simplest way to remove this attack surface is to give the agent no persistent memory. If you need memory, keep configuration (sources, thresholds, parameters) outside the agent's write access and separate it from observations, such as the last price. Writes go through a non-AI service, just like signing. It checks the schema, source, range against the previous value, and the write limit per round. If a check fails, the write is dropped and an alert fires. These checks limit damage; they don't prove an accepted value is correct.

Bitget reports $351.6M in unauthorised transfers from its hot and warm wallets. As with last year's largest hack, the apparent failure lies outside smart contracts. It is encouraging that layered custody appears to have limited the impact to those wallet tiers. The loss is still significant, and Bitget says its protection fund will cover it. Bitget's CEO says private keys were not leaked and points to a compromised wallet backend. How did the attacker gain access and trigger the transfer authorisation process? We await the full postmortem.

AI agent as an oracle: autonomous and capable. But risks lurk both on-chain and off-chain. Today: on-chain. Risks and solutions. 🧾Evidence and shared mistakes The agent can read a poisoned page or misunderstand a source. Several agents can reach the same wrong answer if they use the same model, prompt, or data. Attach a retrievable evidence record and its hash to the report. Use independent sources and reviewers. A hash shows what was submitted, not whether it is true. ✒️Writes and signatures One agent with one key just needs that key to be stolen. Hence a quorum of independent agents. But the contract must make sure nobody gets counted twice: verify authorised signers, sort recovered addresses, and require each address to exceed the previous one. Bind signatures to the report, chain, contract, and a consumed nonce or one-time request ID to prevent replay. 🔻Data freshness The model goes down, the quorum does not form, or a response is delayed. “It just runs” is not a strategy. Bind observedAt to the signed report. Reject future timestamps and data older than MAX_AGE, including when a stored answer is read. The timestamp is still the agent’s claim, so the evidence must be reviewable. 📤Output domain Free text gives the agent room to return something the contract does not expect. For a decision oracle, use a defined set of outcomes. Put UNRESOLVED at 0. In Solidity, an enum defaults to its first value, so an empty result must not look like a decision. Give INVALID its own path. The agent needs a way to say that the evidence is insufficient. 🪟Dispute window If an AI decision is used right after it is written, nobody has time to challenge a wrong interpretation. Keep it pending, then let consumers read only the final outcome. Set a challenge period and bond around the value at risk and the cost of review. This suits decisions such as prediction market resolution, where an answer may require judgment. ⭕Agent outage The agent goes silent, but the protocol must not freeze or keep acting on an old answer. Define a plan B: restrict actions that depend on the answer while preserving protective actions, use another validated source, or allow governed manual resolution. The contract must define when an agent’s answer is valid, when it can be challenged, and what happens when no answer arrives.

We are glad to pass the bar to become a verified cybersec organisation for the @AnthropicAI

CODESPECT is more than a smart contract audit firm. We are an offensive cybersecurity company operating across Web3 and Web2. We combine smart contract expertise with application security and adversarial testing to review the full attack surface: contracts, websites, APIs, bots, backend systems, and off-chain logic. Our work is neither AI-only nor manual-only. It is a rigorous combination of advanced tooling, AI-assisted analysis, and experienced human security researchers. We are not positioned as the cheapest provider, nor are we priced for appearances. Our pricing reflects the depth of work, responsibility, and skilled team required to protect serious protocols. We have maintained this standard even in a difficult market because security cannot be reduced to a checkbox. It is a shared responsibility between protocol teams and auditors. Our team holds certifications including CRTP, OSCP, CEH, and eCPPTv2, with experience across private institutional engagements and competitive reviews such as SpecSiege. In DeFi, our expertise spans vaults, options, RWAs, leverage, order books, lending and borrowing, and more. Clients come to CODESPECT for a review. They return for a long-term security partnership. Code. Inspect. Protect.