vulnerabilities

#Thorchain , a decentralized liquidity protocol, is facing significant challenges as its native token, $RUNE , undergoes a steep decline in value. These developments expose critical #vulnerabilities in its lending mechanics, raising serious questions about the protocol's long-term viability and solvency.

The Lending Mechanism and Its Flaws
Thorchain introduced a lending feature allowing users to borrow assets by collateralizing Bitcoin ($BTC ). Upon borrowing, the system converted BTC collateral into RUNE, creating an inherent dependency on RUNE's value. The repayment process would require selling #RUNE to reacquire #BTC , leaving the protocol exposed to a cascading failure if RUNE's price fell.

This mechanism is now showing cracks:
Death Spiral Dynamics: A drop in RUNE's price creates pressure as borrowers repay loans, forcing the protocol to sell more RUNE to meet BTC obligations. This selling further depresses RUNE’s value, triggering a vicious cycle of price declines.Minting RUNE: To address outstanding liabilities, the protocol mints additional RUNE tokens. At the current price levels, complete loan closure would require the minting of 24 million RUNE tokens, exacerbating the oversupply issue and diluting the token's value.

Outstanding Liabilities and Pool Liquidity
The protocol’s current liabilities include:
BTC Collateral: 1,604 BTC is owed, but only 592 BTC is available in Thorchain's BTC pool.ETH Collateral: 18,258 ETH is owed, with 7,404 ETH available.
The gap in reserves is stark: 210 BTC and 1,725 ETH remain unaccounted for. This shortfall highlights the inability to fully repay depositors, even if borrowers return half of the owed amount.

Market Dynamics and Risks
Several factors are intensifying the crisis:
Shallow Pools: Liquidity pools for BTC and ETH are insufficient to cover liabilities, and the declining RUNE price discourages further liquidity provision.Shorting RUNE: Market participants are capitalizing on RUNE’s weakness, shorting the token and accelerating its decline.Arbitrage Opportunities: A widening gap between RUNE and BTC prices creates opportunities for arbitrage, further depleting USD liquidity pools.

Current Solvency Status
At current market prices, Thorchain's solvency hangs by a thread:
Available USD liquidity in the protocol is approximately $22-$23 million.Outstanding unmet liabilities exceed $24 million.

If RUNE's price continues to drop, the protocol will face a solvency crisis, triggering further panic and liquidation risks.

Broader Implications
The unfolding situation bears striking similarities to the Terra/Luna collapse in 2022. Both scenarios involved unsustainable tokenomics and over-reliance on volatile native tokens to back significant financial obligations. Thorchain's failure to account for systemic risks in its lending design now threatens the integrity of the entire protocol.

Lessons and Path Forward
The Thorchain crisis underscores an essential lesson for the crypto space: poorly designed systems with inherent vulnerabilities are prone to failure. Transparent and sustainable mechanisms, such as over-collateralized loans with minimal exposure to native token fluctuations, are crucial for maintaining stability.
Protocols like Lava, which embed traditional lending logic into smart contracts without relying on ponzinomics, offer a safer alternative for borrowing against assets like BTC. Such models avoid the cascading risks that arise from token dependency.

Call to Action
Immediate action is required to address Thorchain’s vulnerabilities. A coordinated focus on mitigating lending risks, improving liquidity, and stabilizing RUNE’s price is essential to prevent further damage. Institutions and users must remain vigilant as the situation evolves, as the crisis could have far-reaching consequences across the decentralized finance (DeFi) ecosystem.
Thorchain's current predicament serves as a cautionary tale. The promise of DeFi lies in decentralization and security, but these principles must be backed by robust and sustainable economic models. Without these, the industry risks repeating the mistakes of the past.
#RUNE/USDT
$RUNE

As the blockchain and Web3 ecosystems continue to expand, so too does the sophistication of the threats targeting smart contracts. With financial losses totaling $1.42 billion across 149 documented incidents in 2024, it has become critical for developers and security professionals to address vulnerabilities effectively. The OWASP Smart Contract Top 10 (2025) serves as a comprehensive guide to mitigating the most significant risks in the decentralized technology landscape.
What Is the OWASP Smart Contract Top 10?
The OWASP Smart Contract Top 10 (2025) is a standardized awareness document designed to help Web3 developers and security teams identify and mitigate the top vulnerabilities commonly found in smart contracts. By focusing on these critical weaknesses, OWASP aims to ensure the security and stability of decentralized ecosystems. This initiative aligns seamlessly with OWASP's mission to improve software security through open-source projects and community education. By leveraging insights from authoritative sources, including SolidityScan’s Web3HackHub and other expert analyses, the Smart Contract Top 10 highlights the vulnerabilities that pose the greatest threat to smart contract integrity and functionality.
The 2025 OWASP Smart Contract Top 10 Vulnerabilities

Here’s a detailed look at the vulnerabilities that have caused significant disruption and financial loss in decentralized systems:
Access Control VulnerabilitiesDescription: Insufficient enforcement of permission checks can allow unauthorized users to access or modify critical contract data or functions.Impact: Access control flaws accounted for $953.2M in losses in 2024, making them the most exploited vulnerability.Price Oracle ManipulationDescription: Manipulating oracle feeds to alter contract logic and trigger financial losses or instability.Impact: Losses totaled $8.8M due to this exploit, emphasizing the need for secure integration with external data sources.
Logic ErrorsDescription: Flaws in business logic result in unintended behavior, such as incorrect token distributions or flawed lending mechanisms.Impact: These errors caused $63.8M in damages in 2024.Lack of Input ValidationDescription: Failure to validate inputs can lead to harmful manipulation of contract logic.Impact: This vulnerability resulted in $14.6M in losses.Reentrancy AttacksDescription: Exploiting the ability to reenter a function before its execution is complete, often draining funds or breaking contract logic.Impact: These attacks caused $35.7M in financial losses.Unchecked External CallsDescription: Ignoring the success or failure of external function calls can compromise contract functionality.Impact: While less frequent, this flaw resulted in $550.7K in losses.Flash Loan AttacksDescription: Exploiting the ability to execute multiple actions in a single transaction using flash loans.Impact: Losses totaled $33.8M from these attacks.Integer Overflow and UnderflowDescription: Errors in arithmetic operations caused by exceeding integer limits can disrupt calculations and result in theft.Impact: This vulnerability remains a persistent threat due to its technical simplicity.Insecure RandomnessDescription: Predictable or manipulable randomness in lotteries, token distributions, or other functions can lead to exploitation.Impact: The deterministic nature of blockchain networks exacerbates this challenge.Denial of Service (DoS) AttacksDescription: Exploiting vulnerabilities to exhaust contract resources and disrupt functionality.Impact: These attacks are often designed to disrupt normal operations by consuming excessive gas or causing infinite loops.
Data Sources and Insights
To create the OWASP Smart Contract Top 10 for 2025, data was gathered from multiple authoritative sources, including:
SolidityScan’s Web3HackHub (2024): Documenting 149 incidents, this resource highlighted access control vulnerabilities, logic errors, and reentrancy attacks as the top threats.Peter Kacherginsky’s “Top 10 DeFi Attack Vectors - 2024”: This analysis provided critical insights into evolving threats.Immunefi Crypto Losses Report: Supplemented the research with additional data on financial impacts.
These sources reveal not just the technical methods of attack but also the financial and operational impact of vulnerabilities across decentralized ecosystems.
Why This Matters

For Developers:
Incorporate secure coding practices to address the vulnerabilities outlined in the Top 10.Use the OWASP Smart Contract Top 10 as a checklist during the development lifecycle.

For Organizations:
Reduce financial and reputational risk by ensuring smart contracts are resilient to these common threats.Stay ahead of attackers by implementing comprehensive security audits and integrating tools like #SolidityScan .

For the Web3 Community:
Promote the importance of security in decentralized systems to ensure the sustainability of the ecosystem.Support open-source initiatives like OWASP to foster collaboration and knowledge sharing.
Conclusion
The OWASP Smart Contract Top 10 (2025) is a crucial tool for securing the decentralized future. By addressing the #vulnerabilities outlined in this document, developers and security professionals can reduce risks, protect assets, and build trust in blockchain technologies. The project underscores the importance of collective efforts to enhance security through open-source initiatives and community education.
$ARKM
$CTK
$QNT

#Firmware emulation is an essential process in embedded system research and #cybersecurity , enabling analysts to test, inspect, and identify #vulnerabilities in firmware without needing access to physical hardware.
Tools such as QEMU, Firmadyne, and the Firmware Analysis Toolkit (FAT) are vital for emulating Linux-based firmware used in routers, IoT devices, and other embedded systems. This article breaks down these tools, providing a step-by-step guide on how to utilize them effectively for firmware analysis.
QEMU: Versatile Processor Emulation
QEMU (Quick EMUlator) is a widely-used, open-source emulator capable of simulating various hardware architectures. It operates in two primary modes:
1. User-Mode Emulation: This allows the execution of user-space applications compiled for a different architecture. This mode is handy for running and analyzing individual binaries without full system overhead, often useful in situations where only a single application or service needs to be emulated.

2. Full-System Emulation: In this mode, #QEMU can emulate an entire hardware system, including the CPU, memory, and peripherals. It supports multiple architectures such as x86, ARM, MIPS, PowerPC, and SPARC, allowing researchers to run entire operating systems within the emulated environment. This is particularly beneficial for firmware analysis because it enables testing the complete firmware in a simulated environment.
QEMU is a robust and low-level tool, often requiring manual configuration to run embedded firmware. Its wide architecture support makes it a popular choice for those dealing with IoT and embedded devices.

Using QEMU with Python

Firmadyne: Firmware Emulation Framework
Firmadyne is an automated system built on top of QEMU, specifically designed for analyzing #Linux -based embedded firmware. It focuses on extracting and emulating firmware from devices such as routers, IP cameras, and other IoT systems. Key features include:
- Firmware Extraction: Firmadyne extracts key elements like the kernel and root filesystem from firmware images. This is essential, as most firmware comes packaged in proprietary formats, which must be unpacked before analysis.

- System Emulation: Using QEMU under the hood, Firmadyne emulates the extracted firmware. This enables researchers to interact with the system through a virtual console, simulating the actual device behavior.

- Vulnerability Detection: Firmadyne has built-in automation for discovering potential vulnerabilities, such as open network services or insecure configurations.
Firmadyne is highly effective for large-scale research projects because it supports automated batch processing of firmware images and can handle firmware from various manufacturers and architectures (primarily MIPS, ARM, and x86).

Automating Firmadyne Workflow with Python

Firmware Analysis Toolkit (FAT): Simplifying the Process
The Firmware Analysis Toolkit (FAT) is a wrapper around Firmadyne, created by the Attify security group. Its purpose is to simplify the often tedious setup and configuration of Firmadyne, making firmware emulation more accessible, especially for beginners. FAT offers:
- Automated Setup: Instead of manually configuring Firmadyne, users can leverage FAT's simplified scripts to automate firmware extraction, setup, and QEMU-based emulation.

- User-Friendly Workflow: By merely pointing FAT to a firmware image, it performs extraction, sets up the emulated environment, and launches the system in QEMU for further interaction. This streamlines the entire process, which can otherwise be complex and time-consuming.
However, FAT is limited to Linux-based firmware, and its emulation support is constrained by the firmware types that Firmadyne can handle.
Emulation Steps for Firmware Analysis
1. Identify the Firmware's Architecture: Firmware usually runs on architectures like MIPS, ARM, or x86. Identifying the correct architecture is critical because tools like QEMU need this information to emulate the firmware correctly. You can identify the architecture from metadata within the firmware image or using tools like binwalk or file.
2. Use QEMU or FAT for Emulation: Depending on the firmware, QEMU's user-mode or full-system mode may be used. FAT simplifies this by automatically setting up QEMU in the appropriate mode for the firmware in question, typically requiring little user intervention beyond supplying the firmware image.
3. Extract and Emulate: Tools like binwalk, firmware-mod-kit, or Firmadyne are used to extract the contents of the firmware image. Once the root filesystem and kernel are extracted, emulation can begin. If using FAT, this step is largely automated.
4. Interaction with the Emulated System: After emulating the firmware, users can interact with the virtual environment via the QEMU console or connect through services like SSH or Telnet, if the firmware enables them. This allows a thorough inspection of the device's behavior.

Using Firmware Analysis Toolkit (FAT) with Python

Advanced Techniques: Debugging and Analysis
1. Debugging with gdbserver: QEMU supports remote debugging through gdbserver, which allows the user to attach a debugger (like gdb) to a running process in the emulated environment. This is useful for reverse engineering and dynamic analysis of the firmware's functionality.
2. Modifying Initialization Scripts: In some cases, you can gain shell access to the emulated system by modifying initialization scripts like /etc/inittab. This can trigger the system to open a shell, allowing deeper exploration.
3. Custom Toolchains: For certain embedded systems, custom toolchains may be required to compile and run binaries compatible with non-standard hardware architectures (e.g., proprietary MIPS variants). Researchers often need to use these toolchains to cross-compile custom binaries for testing in the emulated environment.
Challenges and Limitations
While firmware emulation offers powerful insights into the behavior of embedded devices, it is not without limitations:
- Incomplete Support: Some firmware, particularly for proprietary or highly specialized devices, cannot be fully emulated due to missing or unsupported peripheral emulation in QEMU.

- Closed Firmware Architectures: Devices using custom or undocumented architectures may require additional reverse engineering effort before they can be emulated.
- Dynamic Analysis Complexity: Even with tools like Firmadyne and FAT, analyzing dynamic behaviors, such as real-time network communication, can be complex without complete hardware replication.

Debugging with GDB in QEMU

Firmware emulation using tools like QEMU, Firmadyne, and the Firmware Analysis Toolkit enables researchers to conduct in-depth analysis of embedded systems without the need for physical hardware. These tools streamline the extraction, emulation, and interaction with firmware, offering a practical approach to identifying vulnerabilities. While challenges exist, such as limited support for proprietary hardware, emulation remains a key component of modern embedded system security research.
Special thanks to SecNigma

Cryptographic systems underpin decentralized finance (DeFi) and blockchain ecosystems, offering users unparalleled control over digital assets. However, the sophistication of these systems also opens up a variety of attack vectors, from smart contracts to multisig wallets, and even hardware wallets. Developers, often focused on functionality, may overlook critical vulnerabilities, creating opportunities for sophisticated attacks like those seen in the Radiant Capital $50M hack. This article will explore the vulnerabilities within crypto systems and provide detailed insights into how they occur, drawing on the latest attack trends and often-overlooked developer mistakes.

1. Smart Contract Vulnerabilities
How They Occur:
Smart contracts are self-executing contracts with the terms of the agreement directly written into code. Their functionality is often complex, and errors or #vulnerabilities in the code can lead to catastrophic results. Hackers can exploit issues such as:
- Reentrancy Attacks: When a smart contract calls an external contract, attackers can use #reentrancy to exploit the sequence of code execution, draining funds.
- Example: In the 2016 DAO attack, reentrancy was used to repeatedly withdraw funds before the contract’s balance was updated, resulting in $60M of stolen $ETH .

- Unchecked Return Values: Developers often overlook checking the return values of low-level calls. This can lead to a contract assuming a call has succeeded when it has not, leaving the contract vulnerable to exploitation.
- Integer Overflow/Underflow: If a contract uses arithmetic operations without proper checks, overflow and underflow issues can occur. Attackers can #exploit these to create infinite tokens or drain funds.

- Exploiting Token Approvals: Many DeFi protocols require users to approve token transfers. Attackers can exploit ongoing approvals or smart contracts that fail to properly manage token allowances.
Mitigation Measures:
- Use Libraries: Utilize audited libraries like OpenZeppelin to avoid common pitfalls in solidity programming such as integer overflow.
- Reentrancy Guards: Include reentrancy guards to prevent recursive calls that could drain funds.
- Audit Smart Contracts: Regularly audit contracts to detect vulnerabilities before deployment.
- Limit Permissions: Encourage users to regularly review and revoke token approvals using tools like Etherscan’s token approval checker.

2. Multisig Wallet Vulnerabilities
How They Occur:
Multisig wallets (e.g., Gnosis Safe) require multiple private keys to authorize transactions, creating a barrier against single-point failures. However, if one or more signers are compromised, the system’s security can break down. Here’s how #Multisig wallets can be attacked:
- Endpoint Compromise: Attackers can install malware, such as a Trojan, on team members' computers. This malware can intercept and modify signing requests before they are sent to the multisig wallet. In the Radiant Capital hack, a Trojan altered transaction data, tricking the hardware wallet into signing a malicious transfer of ownership without detection.

- Hardware Wallet Interception: While hardware wallets are designed to securely sign transactions, they can still be manipulated if the device used to interact with the hardware wallet is compromised. If malware intercepts the transaction data before it reaches the hardware wallet, the user unknowingly approves a malicious transaction.
- Atomic Execution Exploits: Attackers bundle several malicious actions (e.g., ownership transfers, contract upgrades) into one atomic transaction, making it nearly impossible to stop or detect the malicious activity before the funds are stolen.
Mitigation Measures:
- Endpoint Security: Implement anti-malware solutions on devices used for signing transactions. Keep these devices isolated from internet access where possible to reduce the risk of malware infections.

- Cross-verification of Transactions: Ensure that all multisig signers review transaction data on different devices to detect any manipulation. If the same transaction appears differently on separate devices, it should trigger an immediate investigation.
- Timelocks and Governance: Introduce timelocks to delay critical operations such as ownership transfers or large fund movements. Use governance processes to require community or multi-layer multisig approval for contract upgrades or ownership changes.

3. Hardware Wallet Vulnerabilities
How They Occur:
Hardware wallets provide offline storage of private keys, adding a layer of security against #hacks . However, they can still be exploited through indirect means:
- Man-in-the-Middle Attacks: If a computer interacting with a hardware wallet is compromised, attackers can intercept and alter transaction requests before they are displayed on the hardware wallet screen. The user might sign a transaction believing it is legitimate, when in reality they are approving a malicious one.
- Physical Attacks: Supply chain attacks can compromise hardware wallets at the manufacturing level, where malware is introduced during the production process. If the hardware wallet is tampered with before it reaches the user, attackers can potentially access the private keys.
- Malware-Based Attacks: Like in the Radiant Capital hack, Trojans can replace legitimate transactions with malicious ones before they are sent to the hardware wallet, leading to unauthorized actions, such as contract upgrades or ownership transfers.
Mitigation Measures:
- Use Air-gapped Devices: Sign transactions using air-gapped devices that are not connected to the internet to reduce exposure to malware.

- Cross-check Transactions: Ensure users always check the transaction details on their hardware wallet’s screen before confirming, comparing them with the intended action.

- Regular Firmware Updates: Keep hardware wallets updated with the latest firmware to patch any potential vulnerabilities.

- Device Authentication: Use hardware wallets from reputable manufacturers that include device authentication mechanisms to prevent tampering during the supply chain process.

4. Multisig Best Practices and Signature Verification
Even though multisig wallets add layers of security, they are not foolproof. Weaknesses often arise from how multisig transactions are verified and executed, particularly in setups involving hardware wallets.
How Vulnerabilities Occur:
- Compromised Signers: If one or more signers in a multisig wallet are compromised, attackers can manipulate transaction requests, as seen in the Radiant Capital hack. The infection of team members' computers allowed for manipulation of multisig transactions before the hardware wallet even signed them.

- Weak Cross-Verification: Multisig signers may assume that because they are in a secure setup, they do not need to verify transactions across multiple devices. This assumption can be exploited by attackers who alter transaction requests at the endpoint.
Mitigation Measures:
- Distributed Signing: Multisig signers should verify transactions across multiple devices and display methods to detect potential discrepancies in the data.

- Anomaly Detection: Use anomaly detection systems to flag unusual transactions for review. Any inconsistencies between what is shown to different multisig signers should trigger a halt in the transaction.

5. Mitigation Lessons from Radiant Capital's Attack
The Radiant Capital hack is a reminder that even the most sophisticated systems are vulnerable to multi-layered attacks that blend malware, multisig exploitation, and hardware wallet manipulation. The attack showed that combining multiple vulnerabilities (Trojan malware, hardware wallet interception, and atomic execution) can create an exploit that bypasses many traditional defenses.
Key lessons:
- Always Assume Endpoints Can Be Compromised: Even with a secure hardware wallet, attackers can intercept and modify transactions at the computer level. Therefore, endpoint security must be a top priority.

- Atomic Execution Monitoring: Implement real-time monitoring of atomic transactions that can flag malicious activity before they are executed on-chain.

- Governance and Timelock Mechanisms: Timelocks should be mandatory for sensitive operations, and governance processes should be in place to delay or prevent suspicious actions.
By adopting a multi-layered approach to security, including smart contract audits, endpoint protections, and cross-verification of transactions, developers and users can better safeguard their assets from the increasingly sophisticated landscape of crypto exploits.