Blog

Solidity Security Vulnerabilities: A 2026 Guide

Solidity Security Vulnerabilities Solidity security vulnerabilities cause the majority of value lost in Web3. Because …

You Pay For What You Touch: Locality as Ethereum's Next Cost Model

This post is based on a talk given by Neville Grech at the Stateless Summit 2026, drawing on a 2021 study Dedaub conducted for the Ethereum Foundation on the impact of Vitalik Buterin’s Verkle tree gas metering proposal — the direct precursor of EIP-7864. TL;DR Real-world Ethereum contracts are written to fight today’s gas model — not to respect locality. Under EIP-7864, the unified binary tree replacing the 16-way Merkle-Patricia trie, access locality becomes a first-class cost dimension: you pay extra every time execution touches a code chunk or a storage slot that lives outside the small co-located region around the contract account. In a 2021 Dedaub study commissioned by the Ethereum Foundation, we measured a net ~26% gas cost increase on existing contracts under the precursor Verkle proposal, with ~96% of internal transactions worse off. That number sounds alarming. It is also a one-time, upper-bound repricing of contracts written with zero awareness of locality. Most of the gap is closable by compilers, standard libraries, and a handful of opt-in primitives. This post walks through the cost model, the systematic patterns that misbehave under it, and concrete optimization opportunities.

A Discussion on the Immunefi Firewall: Design, Use Cases, and Real-World DeFi Security

DeFi Needs Firewalls: From Program Analysis to Real-World Defense A conversation between Mitchell Amador (CEO, Immunefi) and Yannis Smaragdakis (Co-founder, Dedaub) Introduction In this conversation, Dedaub co-founder Yannis Smaragdakis and Mitchell Amador (CEO of Immunefi) discuss the evolution of smart contract security, drawing on decades of program analysis research and hands-on experience securing real-world DeFi protocols.

Reentrancy in Aptos Move: Insights from 300+ Audits

Introduction to Move The Move language is a next-generation smart contract programming language originally designed for the Libra (later Diem) blockchain, a project since discontinued. Today, Move powers platforms like Aptos and Sui. Its hallmark is a focus on safety and expressiveness, particularly regarding digital assets. It enforces strong resource semantics, making it difficult to accidentally lose or duplicate tokens, a significant advantage over traditional smart contract languages. The Early Days: Move and (the Lack of) Reentrancy In web3 security, reentrancy vulnerabilities are notorious for enabling high-profile exploits (such as the DAO hack on Ethereum). Reentrancy refers to the execution of a second call to a contract before the first invocation is completed. Move, by design, did not support reentrancy in its early versions.

Solidity Security Vulnerabilities: A 2026 Guide

Solidity Security Vulnerabilities Solidity security vulnerabilities cause the majority of value lost in Web3. Because …

You Pay For What You Touch: Locality as Ethereum's Next Cost Model

This post is based on a talk given by Neville Grech at the Stateless Summit 2026, drawing on a 2021 study Dedaub …

A Discussion on the Immunefi Firewall: Design, Use Cases, and Real-World DeFi Security

DeFi Needs Firewalls: From Program Analysis to Real-World Defense A conversation between Mitchell Amador (CEO, …