Security research, incident post-mortems, engineering notes, and shorter garden entries.https://www.mart1n.xyz/enhttps://www.mart1n.xyz/security/allbridge-core-solana-same-pool-account-aliasing-drain/https://www.mart1n.xyz/security/allbridge-core-solana-same-pool-account-aliasing-drain/A forensic analysis of the July 2026 Allbridge Core Solana drain: duplicate source and destination pool accounts were accepted by swap, repeated same-token calls compounded internal vUSD state, and approximately 1.657 million nominal stablecoin units left the USDC and USDT vaults.Mon, 20 Jul 2026 00:00:00 GMTSecuritysolanabridgestablecoinflash-loanpost-mortemincidenthttps://www.mart1n.xyz/security/hinkal-usdc-shielded-pool-drain/https://www.mart1n.xyz/security/hinkal-usdc-shielded-pool-drain/A forensic writeup of the Hinkal USDC shielded-pool drain: five attacker addresses deposited 27,900 USDC, withdrew 800,992.64 USDC, and emptied the pool through proofs that appeared valid but failed to conserve hidden note value.Mon, 06 Jul 2026 00:00:00 GMTSecurityzkprivacypost-mortemincidenthttps://www.mart1n.xyz/security/summerfi-fleetcommander-nav-donation-drain/https://www.mart1n.xyz/security/summerfi-fleetcommander-nav-donation-drain/An attacker drained ≈$6.0M from Summer.fi's Lazy Summer FleetCommander (LVUSDC) USDC vault in a single flash-loan-funded transaction. The lever: donate illiquid, pre-positioned SiloVault shares into an ark so the FleetCommander books them at full NAV, then round-trip deposit → donate → redeem in one call. A walkthrough of the nested-ERC-4626 accounting flaw and the prepared share funding leg traced back to FixedFloat.Mon, 06 Jul 2026 00:00:00 GMTSecurityvaulterc-4626nav-manipulationflashloanpost-mortemhttps://www.mart1n.xyz/security/zerolend-liquidity-index-manipulation/https://www.mart1n.xyz/security/zerolend-liquidity-index-manipulation/A low-liquidity ZeroLend market backed by a post-maturity Pendle PT (PT Lombard LBTC 29MAY2025) was drained of ~4 LBTC. The attacker pumped liquidityIndex via flashloan premiums, accumulated ~10.9955 PT-LBTC via rounding-window arbitrage, then borrowed real LBTC against the drained collateral. A walkthrough of the on-chain facts and the accounting bugs that made it work.Fri, 08 May 2026 00:00:00 GMTSecuritylendingflashloanpost-mortemhttps://www.mart1n.xyz/research/processor-role-design-in-credit-vaults/https://www.mart1n.xyz/research/processor-role-design-in-credit-vaults/Trusted off-chain operators are the rule, not the exception, in credit-vault stablecoins. The interesting question is what bounds the role on-chain. A short comparison using Saturn Credit as a starting point.Sat, 02 May 2026 00:00:00 GMTResearchstablecoinoperator-riskvault-design