Blog
Technical insights
Deep dives into smart contract vulnerabilities, blockchain security best practices, and technical research from CertiK engineers.
EducationalIntroducing Aleo: A Premier Platform for Private Blockchain ApplicationsAleo Systems has created a Layer 1 blockchain named Aleo with a focus on privacy achieved through the use of zero-knowledge proofs (ZKPs) and other cryptographic methods. Unlike most popular blockchains where data used and created by transactions can be viewed by an external observer, Aleo provides the ability to hide such information. 
Technology analysisBreaking Down Proof Construction in Plonky3: The Fibonacci Example UnveiledThis article examines the inner workings of Polygon’s Plonky3, a state-of-the-art prover utilized in zero-knowledge Virtual Machines (zkVMs). 
Technology analysisEVM – Cosmos Convergence Research From Security Base: Part 3This in-depth analysis will illuminate how the judicious separation of concerns between these layers can engender enhanced scalability, flexibility, and interoperability within the blockchain domain, ultimately shaping the future trajectory of decentralized applications and networks.
Technology analysisThreshold Cryptography V: Auxiliary Zero-knowledge ProofsIn this post, we analyze the specific ZKP constructions implemented in Binance’s tss-lib [1]. These proofs address previously identified weaknesses in the Multiplicative-to-Additive (MtA) protocol, Paillier encryption parameters, and auxiliary RSA modulus generation. Our discussion is grounded in the improvements formalized by the specifications in CGGMP21 [4], which strengthen the robustness of threshold ECDSA against known attacks.
EducationalMove for Solidity Developers IV: Cross-Contract CallIn this article, we delve into the concept of cross-contract calls and examine the distinctions between Solidity and Move contracts in this area. We will assess the mechanisms and security of executing cross-contract calls in Move, aiding developers in better comprehending how to manage contract interactions within the Move environment.
Technology analysisLottie File Incidents: Case Studies of Third-Party Supply Chain RisksThis post details two security incidents involving the Lottie animation format and its ecosystem, highlighting the persistent and evolving nature of third-party dependency and supply chain risks in the modern web landscape.
Technology analysisThreshold Cryptography IV: Multiplicative-to-Additive (MtA) Protocol and Paillier Encryption SchemeIn this post, we provide a detailed examination of the MtA protocol, which utilizes the additively homomorphic properties of the Paillier encryption scheme to facilitate the exchange of encrypted secret shares among the participating parties.
Technology analysisThreshold Cryptography III: Binance tss-lib’s 9-Round Threshold ECDSAThis third post in the Threshold Cryptography series provides a bird’s-eye view of the 9-round threshold ECDSA protocol implemented in tss-lib [1]. Detailed exposition of the underlying MtA secret share conversion protocol and zero-knowledge proofs will follow in the next two posts.
Technology analysisSecurity Risks of StablecoinsStablecoins are a type of crypto-asset designed to maintain a stable price by linking each token to an external reference asset, most often a national currency like the U.S. dollar, but sometimes commodities like gold. In theory, every coin in circulation should be redeemable for an equal amount of that reference asset, protecting holders from the sharp price fluctuations typical of unpegged digital currencies.
Technology analysisPrivate Key, Public RiskIn Web3, private keys are critical for controlling assets, governance, and trust, but their mismanagement poses significant risks, including financial loss and reputational damage. This article explores secure private key generation, storage, and usage to mitigate these vulnerabilities.
Technology analysisMove for Solidity Developers: Token Standard II — Advanced Fungible Token ExtensionsBuilding on our previous analysis of basic token functionalities across Solidity, Sui Move, and Aptos Move, this report focuses on the advanced features of fungible tokens. We specifically explore how these platforms implement fungible token standards, with extensions such as whitelisting/blacklisting, fee mechanisms, pausing, and whitelisting/blacklisting.
Technology analysisThreshold Cryptography II: Unidentifiability in Decentralized FROST Implementation The second post in our Threshold Cryptography series explores the FROST threshold signing protocol, as proposed in FROST: Flexible Round-Optimized Schnorr Threshold Signatures [1], and highlights a potential issue that arises when implementing the protocol in a decentralized setting. This issue allows a malicious participant to send inconsistent nonce commitments, leading to honest participants to be falsely accused of misbehavior.