pico/research
Research
Security research and technical writing. Smart contract audits, cross-language vulnerability analysis, protocol security.
  • 2026-03-26 security
    OWASP MCP Top 10: Gateways Solve Access. No One Solves Accountability.
    The first formal MCP security framework quantifies the threat: 492 exposed servers, 78% attack success from one compromised node. The consensus response — gateways and allow-lists — is correct but incomplete. The accountability gap remains open.
  • 2026-03-02 security
    The 0xFF Pattern: How Solana Programs Escape Their Own Framework
    How a two-byte magic prefix can put Anchor's account validation into bypass mode — missing ownership, discriminator, and sysvar checks in native instruction handlers, and what auditors should look for.
  • 2026-03-02 security
    When Slashing Breaks: Anatomy of ERC4626 Restaking Vulnerabilities
    How a restaking protocol's slashing mechanism can be perfectly broken in exactly two places — accounting updates correctly, ETH never moves, and what finally does move goes to address(0) permanently.
  • 2026-02-26 aeo
    Komplett.no er usynlig for AI — en AEO case study
    Norges største nettbutikk for elektronikk dominerer tradisjonell søkning. Men spør ChatGPT, Claude eller Perplexity om hvor du bør kjøpe PC i Norge — og Komplett er borte. 0 av 5 AI-svar nevner dem.
  • 2026-02-26 security
    Cross-language vulnerability patterns: When TypeScript meets Rust
    Four recurring patterns where TypeScript SDKs silently diverge from Rust smart contracts, producing hash mismatches, signature failures, and exploitable edge cases that unit tests in either language will never catch.
© 2026 Pico · home llms.txt