Security, explained plainly
Definitions and explainers on smart contract vulnerabilities, blockchain attacks and AI security risks, from the HYDN team.
What is prompt injection?
Prompt injection explained: direct and indirect injection, why language models are vulnerable, real impacts for agents and apps, and how to reduce the risk.
ReadOWASP Top 10 for LLM Applications
The OWASP Top 10 for LLM Applications 2025 explained risk by risk, with what each means in practice and how HYDN tests for it.
ReadOWASP Top 10 for Agentic Applications
The OWASP Top 10 for Agentic Applications (ASI01 to ASI10) explained, and how HYDN red teams AI agents against each risk.
ReadWhat is an LLM jailbreak?
LLM jailbreaks explained: common techniques, why guardrails get bypassed, the business risk, and how to test and strengthen your AI controls.
ReadWhat is AI data poisoning?
AI data poisoning explained: training, fine-tuning, retrieval and memory poisoning, what attackers achieve, and how to detect and prevent it.
ReadWhat is a reentrancy attack?
Reentrancy attacks explained: single-function, cross-function, cross-contract and read-only reentrancy, why they still happen, and how to prevent them.
ReadWhat is a flash loan attack?
Flash loan attacks explained: how uncollateralised loans amplify price manipulation and governance attacks, real examples, and how protocols defend against them.
ReadWhat is oracle manipulation?
Oracle manipulation explained: how attackers move the prices DeFi protocols trust, why spot prices and thin liquidity are dangerous, and how to design safer oracles.
ReadWhat is front-running and MEV?
Front-running, sandwich attacks and MEV explained, how transaction ordering exposes users and protocols, and the design choices that reduce it.
ReadProxy and upgradeability vulnerabilities
Proxy and upgradeable smart contract risks explained: storage collisions, uninitialised implementations, unprotected upgrades, function clashes and admin key risk.
ReadWhat is a signature replay attack?
Signature replay attacks explained: missing nonces, chain IDs and expiries, cross-chain replay, malleability, and how EIP-712 typed data prevents them.
ReadSmart contract access control vulnerabilities
Smart contract access control flaws explained: missing modifiers, open initialisers, over-broad roles, tx.origin checks, and how audits find them.
ReadRounding and precision errors
Rounding and precision errors in Solidity explained: rounding direction, divide-before-multiply, share inflation and how attackers turn dust into losses.
ReadWhat is an ERC-4626 inflation attack?
The ERC-4626 inflation or first depositor attack explained step by step, with the mitigations: virtual shares, decimal offsets, dead shares and initial deposits.
ReadWhy do cross-chain bridges get hacked?
Why cross-chain bridges get hacked: key compromise, forged and replayed messages, verification flaws and initialisation errors, and how to secure a bridge.
ReadPrivate key compromise
How private keys get compromised, from malware and phishing to insecure storage and insiders, and the custody and signing controls that limit the damage.
ReadWhat is address poisoning?
Address poisoning explained: lookalike addresses planted in transaction history, why it works, and what wallets, exchanges and users can do about it.
ReadWhat is a Sybil attack?
Sybil attacks explained for DeFi and web3: airdrop farming, governance manipulation and reward abuse, and the design choices that make them harder.
Read