thesandf is a Smart Contract Developer and Web3 Security Researcher specializing in Solidity, DeFi protocol audits, and cross-chain security research. View my portfolio, research, and case studies.https://thesandf.com/https://thesandf.com/posts/audit-to-cto/https://thesandf.com/posts/audit-to-cto/Learn why elite smart contract auditors become Web3 CTOs, protocol architects, and founders. Explore the four-stage auditor lifecycle, career roadmap, and how adversarial thinking creates technical leaders.Mon, 22 Jun 2026 00:00:00 GMThttps://thesandf.com/posts/yieldzero-engineering/https://thesandf.com/posts/yieldzero-engineering/Engineering patterns for omnichain vaults using LayerZero, covering messaging, composability, and distributed system challenges.Tue, 10 Mar 2026 00:00:00 GMThttps://thesandf.com/posts/shares-vanished/https://thesandf.com/posts/shares-vanished/A 6-hour LayerZero + ERC-4626 debugging meltdown where shares didn’t disappear - they were just bridged instantly.Sat, 31 Jan 2026 00:00:00 GMThttps://thesandf.com/posts/denial-of-service/https://thesandf.com/posts/denial-of-service/Thor gets stranded when Loki clogs the Bifrost bridge. Learn how DoS in Solidity works, how attackers block withdrawals, and how patterns like pull-payments and gas-optimized loops prevent disaster.Fri, 12 Dec 2025 00:00:00 GMThttps://thesandf.com/posts/sandwich-mev/https://thesandf.com/posts/sandwich-mev/Quicksilver doesn’t steal Iron Man’s suit. He just sandwiches his trade in the mempool and walks away with millions. The fastest, most profitable MEV attack in DeFi - explained with MCU speed.Sat, 29 Nov 2025 00:00:00 GMThttps://thesandf.com/posts/insecure-randomness/https://thesandf.com/posts/insecure-randomness/Orochimaru doesn’t fight Naruto. He just predicts the next block.timestamp and steals the entire Hidden Leaf lottery. The most ninja-level randomness exploit ever told - dattebayo!Fri, 28 Nov 2025 00:00:00 GMThttps://thesandf.com/posts/input-validation/https://thesandf.com/posts/input-validation/Loki doesn’t break the Mirror Dimension. He just walks out pretending to be Iron Man. One missing require() = $41M gone. The ultimate input validation case study.Thu, 27 Nov 2025 00:00:00 GMThttps://thesandf.com/posts/flash-loan-oracle-manipulation/https://thesandf.com/posts/flash-loan-oracle-manipulation/Ant-Man goes quantum: one flash loan, one block, one vault drained. The most devastating oracle attack in DeFi history - now with full code, two exploit scenarios, and MCU chaos.Wed, 26 Nov 2025 00:00:00 GMThttps://thesandf.com/posts/cross-chain-bridges/https://thesandf.com/posts/cross-chain-bridges/Doctor Strange steals the validator key and replays Spider-Man’s message across the multiverse. One signature. Infinite tokens. A $3.2B+ real-world disaster explained with MCU flair.Mon, 24 Nov 2025 00:00:00 GMThttps://thesandf.com/posts/arithmetic-overflow-underflow/https://thesandf.com/posts/arithmetic-overflow-underflow/Thor pushes Hulk’s rage past 255 and drains Iron Man’s suit below zero. Witness the most spectacular math explosions in the MCU and learn why unchecked arithmetic is the silent killer of pre-0.8.0 and inside `unchecked {}` blocks.Sun, 23 Nov 2025 00:00:00 GMThttps://thesandf.com/posts/access-control/https://thesandf.com/posts/access-control/Black Widow infiltrates the most heavily guarded vault in the MCU history… only to discover the doors were never locked. A delicious cocktail of 4 critical access control bugs in one single contract.Sat, 22 Nov 2025 00:00:00 GMThttps://thesandf.com/posts/reentrancy/https://thesandf.com/posts/reentrancy/Doctor Strange traps Dormammu in an infinite time loop. Exactly how reentrancy works - and how attackers drain millions.Thu, 20 Nov 2025 00:00:00 GMThttps://thesandf.com/ctf/compromised/https://thesandf.com/ctf/compromised/Oracle manipulation via compromised private keys. Learn how a leak in server logs can lead to complete price control and the systematic draining of an NFT exchange.Tue, 29 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/puzzle-wallet/https://thesandf.com/ctf/puzzle-wallet/Mastering proxy patterns, storage layout collisions, and msg.value reuse inside multicalls. Learn how to hijack proxy administration by bypassing whitelists and exploiting delegatecall execution flows.Thu, 24 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/naught-coin/https://thesandf.com/ctf/naught-coin/Bypassing transfer locks by exploiting incomplete standard overrides. Learn how standard ERC20 token mechanics allow approve and transferFrom to circumvent direct transfer controls.Tue, 15 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/gatekeeper-two/https://thesandf.com/ctf/gatekeeper-two/Bypassing extcodesize checks and solving bitwise XOR constraints. Learn how the EVM manages code size during constructor initialization and how to derive cryptographic gatekeys.Mon, 14 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/gatekeeper-one/https://thesandf.com/ctf/gatekeeper-one/Bypassing complex multiple gate controls in Solidity. Learn how to solve execution origin barriers, brute-force exact gas constraints, and master bitwise mask operations.Sun, 13 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/privacy/https://thesandf.com/ctf/privacy/Reading packed storage slots and fixed-size arrays from the blockchain. Learn how the Solidity compiler packs state variables and how to cast data types to bypass access controls.Sat, 12 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/elevator/https://thesandf.com/ctf/elevator/Exploiting state-manipulating interface implementations to bypass flow controls. Learn why relying on external untrusted contract state returns can break smart contract invariants.Fri, 11 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/reentrancy/https://thesandf.com/ctf/reentrancy/Exploiting classic reentrancy vulnerabilities. Learn how state modification sequence and unchecked external calls can lead to total contract draining.Thu, 10 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/king/https://thesandf.com/ctf/king/Exploiting smart contract payments to cause a Denial of Service (DoS). Learn how blocking native Ether transfers can lock contract states forever.Wed, 09 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/puppet-v2/https://thesandf.com/ctf/puppet-v2/Evolution of price manipulation on Uniswap V2. Learn how blindly trusting official libraries and increasing collateral requirements still fails if the underlying price oracle remains manipulative.Wed, 09 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/vault/https://thesandf.com/ctf/vault/Reading private storage variables directly from the blockchain. Learn how data visibility modifiers like private do not hide data on public blockchains.Tue, 08 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/force/https://thesandf.com/ctf/force/Forcibly sending Ether to a contract with no receive or fallback functions. Learn how the selfdestruct EVM instruction overrides standard payment controls.Mon, 07 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/delegation/https://thesandf.com/ctf/delegation/Exploiting delegatecall forwarding to hijack smart contract ownership. Learn how delegatecall preserves transaction context and storage layouts to execute arbitrary code.Sun, 06 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/naive-receiver/https://thesandf.com/ctf/naive-receiver/Exploiting fixed fees and identity spoofing. Learn how to drain a user’s balance through forced flash loans and hijack admin privileges via meta-transactions.Sat, 05 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/puppet/https://thesandf.com/ctf/puppet/Oracle manipulation via low-liquidity AMM pools. Learn how to crash the price of a token on Uniswap V1 to borrow an entire lending pool’s liquidity for pennies.Sat, 05 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/the-rewarder/https://thesandf.com/ctf/the-rewarder/A vulnerable Merkle reward distributor that fails to bind claims to the intended recipient, allowing attackers to steal every unclaimed reward.Sat, 05 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/token/https://thesandf.com/ctf/token/Exploiting arithmetic underflows in Solidity versions before 0.8.0. Learn how unsigned integer wrapping can bypass balance checks to mint an astronomical supply of tokens.Sat, 05 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/side-entrance/https://thesandf.com/ctf/side-entrance/Exploring the flaws in flash loan accounting. Learn how to use a contract’s own flash loan to "deposit" into your own account and then walk out with the entire pool.Fri, 04 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/telephone/https://thesandf.com/ctf/telephone/Understanding the critical security distinction between tx.origin and msg.sender. Learn how tx.origin authentication can be bypassed using simple contract proxying.Fri, 04 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/truster/https://thesandf.com/ctf/truster/Arbitrary external calls leading to full permission leaks. Learn how a single flash loan call can trick a contract into approving away its entire treasury.Fri, 04 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/coin-flip/https://thesandf.com/ctf/coin-flip/Exploiting weak on-chain randomness using a smart contract. Learn how transaction execution order and historical block data make deterministic randomness highly exploitable.Thu, 03 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/fallout/https://thesandf.com/ctf/fallout/Exploiting a simple typographical error in a smart contract constructor. Learn how a single character typo can turn a critical initialization function into a public exploit vector.Wed, 02 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/free-rider/https://thesandf.com/ctf/free-rider/Exploiting msg.value reuse in batch processing. Learn how to combine Uniswap V2 flash swaps with a faulty NFT marketplace loop to drain an entire collection for the price of one.Wed, 02 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/fallback/https://thesandf.com/ctf/fallback/Claim ownership and drain the contract by exploiting weak access control in the receive fallback function. Learn about Solidity receive/fallback mechanics and the critical importance of secure defaults.Tue, 01 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/unstoppable/https://thesandf.com/ctf/unstoppable/A masterclass in Denial of Service (DoS) via ledger inconsistency. Learn how a single permissionless transfer can permanently paralyze an ERC4626 vault.Tue, 01 Jul 2025 00:00:00 GMThttps://thesandf.com/ctf/selfie/https://thesandf.com/ctf/selfie/Governance hijacking via flash loans. Learn how a lack of snapshotting allows an attacker to borrow a majority of voting power and pass malicious proposals.Sat, 28 Jun 2025 00:00:00 GMT