Research & Methodology
Reference papers tied to Red Asgard's engagement services. Editions under revision.
Cairo Contract Security: Account Abstraction by Default
Cairo's account-abstraction-everywhere model, L1↔L2 message trust, class-hash upgrades, felt-field arithmetic, and the sequencer-trust assumptions specific to StarkNet.
CosmWasm Contract Security: Replies, Migrations, and IBC
CosmWasm's submessage-and-reply architecture, IBC packet trust, migration handler authority, governance integration, and the bug classes specific to Cosmos's actor model.
Cross-Chain Bridge Security: The New Attack Frontier
Architecture analysis of cross-chain bridge designs and the dominant attack patterns behind the largest exploits – Ronin, Poly Network, BNB Bridge, Wormhole, Nomad.
DeFi Security: Protecting Decentralized Finance Ecosystems
Survey of DeFi attack surfaces – flash-loan manipulation, governance exploits, cross-chain bridge risk, and oracle attacks – with case studies of major incidents.
Gas Optimization vs Security: When Optimizations Become Bugs
Common gas-optimization patterns in Solidity and the security trade-offs that come with each – variable packing, event-vs-storage, custom errors, and assembly shortcuts.
Layer 2 Security: Scaling Without Compromise
Security-model comparison of Optimistic Rollups, ZK-Rollups, sidechains, and state channels – what each inherits from Ethereum, what each gives up, and where the attack surface concentrates.
MCP Security: Auditing the AI Agent Trust Boundary
Red Asgard's methodology for auditing Model Context Protocol deployments – authentication gaps, command-injection in tool implementations, SSRF, context manipulation, capability sprawl, and the structured logging most MCP servers do not emit.
Multi-Chain Audit Catalog: 37 Chains, Five Ecosystems
Audit coverage across 37 blockchains, grouped by ecosystem family: EVM, Solana, Move-based (Sui, Aptos), Cairo (StarkNet), CosmWasm (Cosmos), TON, and the other significant non-EVM L1s. What's shared across the methodology and what's ecosystem-specific.
Smart Contract Auditing: Red Asgard Methodology
How Red Asgard reads a smart contract the way an attacker will read it the minute it is deployed. The pre-read, the pattern catalog, the three passes, the tools, the severity rubric, and what we will not lie about in the report.
Smart Contract Security: Common Vulnerabilities and Defensive Patterns
Working reference for the vulnerability patterns Red Asgard audits surface most often – reentrancy, integer overflow, access-control breaks, oracle manipulation – with defensive patterns and audit-finding examples.
Smart Contract Testing: From Unit Tests to Formal Verification
Layered testing strategy for smart contracts – unit tests, scenario integration, property-based fuzzing (Echidna, Medusa), and formal verification (Certora, Halmos) – and where each layer catches what.
Solana Program Security: Anchor, PDAs, and the Sysvar Bugs
Anchor framework usage, Program Derived Address confusion, signer-account validation, sysvar-account checks, CPI trust, and the bug classes specific to Solana's stateless-program model.
Supply Chain Attack Vectors: From SolarWinds to npm
Detection and prevention patterns for software supply-chain attacks, anchored to documented incidents – SolarWinds, Codecov, ua-parser-js, and the OtterCookie-attributed npm wave Red Asgard tracked through 2025–2026.
Upgradeable Smart Contracts: Patterns and Pitfalls
Transparent proxies, UUPS, diamonds, and Beacons – how each upgrade pattern handles storage, admin authority, and migration; where each pattern has cost protocols real money.