Bug Hunting with Crytic

Summary: Trail of Bits' Crytic GitHub app, which runs 90+ detectors on every commit, found twelve issues across major projects including a critical flaw in E&Y's Nightfall where FTokenShield.mint does not check the return value of transferFrom, allowing anyone to mint free tokens with tokens like BAT that return false instead of reverting. Other findings include an encodePacked collision in DOSNetwork's DOSProxy, a reentrancy in HQ20 that occurs with callback-capable tokens such as ERC777, and a double-counting of msg.value in EthKids' fundWithAward.
What's compelling: The Nightfall flaw let anyone mint free tokens because a single unchecked return value went unnoticed, and the HQ20 reentrancy mirrors the pattern behind the recent Uniswap and lendf.me hacks - both classes of bug that pass a normal review and only surface under automated, per-commit checking.

Read the original at Trail of Bits Blog ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026