Blockchain

Smart Contract Audits: What Actually Gets Caught

An analysis of the defects we most frequently find in production Solidity, and the patterns that prevent them.

codeversols Security1 min read

Across the audits we ran last year, the same handful of issues accounted for the majority of high-severity findings. None of them were exotic.

Access control drift

Contracts start with a clean owner model and accumulate privileged functions. By deployment, nobody can enumerate what the owner key can actually do.

Unchecked external calls

Every external call is a re-entrancy surface and a failure mode. Checks-effects-interactions is old advice because it keeps being necessary.

Economic assumptions

The subtlest bugs are not memory-safety issues, they are incentive bugs: oracle manipulation, sandwichable ordering, and rounding that always favours the same party.

Building something like this?We do this work for a living — tell us what you are trying to ship and we will tell you honestly whether we are the right team for it.

Start a conversation

More From Our Blog

Hybrid search + reranking for RAG isn’t a free win: prove it with margin‑gated evals (or don’t ship it)
AI Engineering • Aug 31, 2026

Hybrid search + reranking for RAG isn’t a free win: prove it with margin‑gated evals (or don’t ship it)

Hybrid (BM25 + vectors) plus a cross‑encoder reranker is now the default RAG advice, but it can make real systems worse. Here’s a practical, eval-driven way to decide when to rerank using similarity margins and failure-mode buckets.

Read more →
The Permission Boundary Pattern: least-privilege tool-using agents without keys to prod
AI Engineering • Aug 30, 2026

The Permission Boundary Pattern: least-privilege tool-using agents without keys to prod

Tool-using agents fail differently to chatbots: they can cross system boundaries. The Permission Boundary Pattern gives you an implementable blueprint for agent identities, per-tool scopes, short-lived credentials, and end-to-end auditability so overreach is detectable and revocable.

Read more →
Hybrid retrieval for RAG is the new baseline: stop vector-only failing on SKUs, error codes and policy text
AI Engineering • Aug 29, 2026

Hybrid retrieval for RAG is the new baseline: stop vector-only failing on SKUs, error codes and policy text

Vector-only RAG fails in predictable places: IDs, SKU-like tokens, exact clauses and compliance language. A production hybrid stack (BM25 + dense + reranking + ACL-aware filtering) fixes this, and you can prove it with a simple evaluation harness.

Read more →