0xrivet
auditing bridges so you don't have to
auditing bridges so you don't have to
open source stuff i built for my own research. migrating repos to public — more showing up over the next few days.
cross-chain bridge security analyzer. checks DVN/validator configuration, timelock detection, admin ownership chains, proxy upgrade patterns, rate limiters, and message verification logic. supports LayerZero V1/V2, Wormhole, Axelar, Hyperlane, Chainlink CCIP.
this is what i use when someone asks me "is this bridge safe?" — the answer is usually more complicated than their docs suggest.
typescript · viem · 50 commits
calldata and trace decoder with delegatecall chain resolution, proxy implementation tracing, and storage slot inspection. includes a Safe/Gnosis multisig transaction decoder — built this after the bybit incident because i wanted to see exactly what those signers approved.
typescript · viem
real-time on-chain event watcher. monitors proxy upgrades, ownership transfers, multisig changes, timelock operations, and large transfers across Ethereum, Arbitrum, Optimism, Base, Polygon. sends alerts via discord and telegram.
typescript · viem · sqlite · docker
discover hidden admin power structures. scans for AccessControl roles, Safe modules that bypass threshold, unrevoked timelock permissions, CREATE2 deployer risks, diamond facet admin functions.
typescript · viem
reconstruct smart contract storage history. binary search for when a value changed, build timelines of proxy upgrades, ownership transfers, timelock delay modifications.
typescript · viem
vulnerability pattern catalog with working Foundry PoCs. reentrancy, proxy upgrades, flash loans, oracle manipulation, bridge replay, signature malleability. includes Wormhole, Ronin, Nomad incident analysis.
solidity · foundry