Blog
Technical insights
Deep dives into smart contract vulnerabilities, blockchain security best practices, and technical research from CertiK engineers.
Technology analysisBlockchain Data Protection and Privacy Compliance: A deep dive on GDPR and HIPAA requirementsBlockchain’s characteristics of immutability, transparency, decentralized data management, and availability have attracted attention across industries, from finance, to supply chain management, to healthcare, and many more. However, these features create significant challenges when it comes to regulatory compliance.
Technology analysisA Preliminary Security Assessment on Web3 Desktop WalletsDesktop wallets play a crucial role in the Web3 ecosystem, providing users with a means to securely manage their digital assets within decentralized networks. This report presents the findings of this technical analysis in detail, aiming to raise user awareness about security, and assist users in better protecting their digital assets when utilizing desktop wallets.
EducationalUnmasking Crypto Market Manipulation: Wash Trading, Spoofing, and MoreMuch like traditional financial markets, crypto markets are not immune to manipulation. Many of the same practices that plague stocks and commodities — like wash trading, spreading fear, and pump and dump schemes — also exist in the crypto space. In this blog, we’ll explore some of the most common manipulation tactics in the crypto markets and discuss how these practices impact the industry as a whole. 
Vulnerability researchWeb2 Meets Web3: Hacking Decentralized ApplicationsThis blog offers insights into the differences between traditional Web2 applications and Web3 Dapps, Dapp threat modeling, and unique attack vectors enabled by the integration of blockchain components.
Vulnerability researchRisk & Security Enhancement for App Chains: An In-depth Writeup of CWA-2023-004In January 2024, CertiK research team, in collaboration with Confio's security contributors, identified and addressed a high-impact vulnerability affecting App Chains that allow permissionless uploads in the CosmosWasm ecosystem. This vulnerability, designated as CWA-2023-004, enables a remote attacker to submit a malformed contract payload, causing a deterministic failure in every transaction processed by the WasmVM. This ultimately leads to a widespread outage across the validator network.
EducationalHow AI is Enhancing Web3: Innovations at the Crossroads of Decentralization Artificial intelligence (AI) and Web3 are two of the most transformative technologies shaping the future of digital interactions. The intersection of these technologies offers intriguing possibilities for enhancing privacy, security, and operational efficiency. 
EducationalClarity: Best Practices and ChecklistsClarity is a smart contract language developed collaboratively by Hiro PBC, Algorand, and other stakeholders. It is currently utilized on the Stacks chain (Bitcoin sidechain). The primary goal of Clarity is to provide a high level of predictability and security, ensuring that smart contracts behave as intended without any unexpected side effects.In this article, we explore the concept behind Clarity smart contracts, as well as best practices and security checklists for programming with Clarity. 
Technology analysisBridge TracingIn this blog we look at how to trace cryptocurrency assets moving cross-chain on some of the most commonly used bridges.
Technology analysisAdvanced Formal Verification of ZKP: How ZK Memory Was ProvenIn this post, we will discuss some interesting technical points that arise along our journey of verifying the zkWasm memory subsystem. The memory is the most distinctive part of a zkVM, so handling this well is a crucial point relevant for all other zkVM verification projects as well.
Technology analysisVanity Address and Address PoisoningVanity addresses are custom wallet addresses created using specific algorithms. These addresses can incorporate a chosen sequence of characters, making them more easily identifiable. Most often, when vanity addresses are mentioned, it refers to the Bitcoin and Ethereum blockchains. 
Vulnerability researchAdvanced Formal Verification of ZKP: A Tale of Two BugsIn this post, we focus on the bug discovery process of our formal verification of zkWasm instructions, examining specific bugs encountered during the process and the lessons learned.
EducationalsCrypt: Nine Smart Contract Development Best PracticessCrypt is an embedded Domain Specific Language (eDSL) based on TypeScript. It’s designed for writing smart contracts on Bitcoin. In this article, we explore the concept behind sCrypt smart contracts, as well as some best practices and security checklists for programming with sCrypt.