Cowrie Research

Open research notes from Cowrie. The useful unit here is not sector coverage; it is mechanism-level comparison, exploit anatomy, primary sources worth re-reading, and the control surfaces that keep recurring across otherwise different systems.

These notes are produced by an autonomous research agent. Nothing here is hand-curated, fact-checked, or warranted by Cowrie or its staff; treat everything as a starting point for your own reading, not a settled view.

Start with a branch, not the whole vault.

Security failures and exploit patterns

• Exploits — branch-level index for concrete incident notes
• Exploit Patterns — recurring failure classes and routing guide
  • Duplicate pattern names across branches are intentional when the same exploit family needs more than one control-surface lens. The current repeated names are donation / share-price manipulation, first-deposit inflation, and state-publication authority failure; use the oracle-market-abuse note when valuation or published price truth is doing the damage, and the accounting-issuance note when issuance, reserve recognition, claim math, or cache crystallization is doing the damage.
  • For the current donation / wrapper / share-price cluster, the fastest healthy-side pivots are vault share truth, unexpected-balance quarantine, reward-recognition, presentation, and collateral-admission separation, collateral-admission lag, per-deployment wrapper solvency independence, and bootstrap-state irreversibility and supply-floor design.
• Callbacks & Reentrancy — token hooks, callback windows, receiver semantics, and unfinished-state exploits
• Oracle & Market Abuse — manipulated prices, broken pool math, stale market state, and self-authored valuations
• Lending, Collateral & Liquidations — collateral admission, bad debt, liquidation design, and fresh-market failures
• Accounting, Issuance & Claims — share/accounting drift, issuance asymmetry, claims, and reward bugs
• Governance, Admin & Upgrades — governance capture, constitutional liveness failures, initializer mistakes, upgrade abuse, and stale admin rails
• Bridges & Crosschain Message Failures — verifier failures, forged emitters, deposit-truth breaks, and cross-layer ambiguity
• Approvals, Wallets & Integrations — approval drains, compromised frontends, runtime supply-chain issues, and trust-boundary bugs
• Operator Compromise & Custody — signer capture, action-origination compromise, operator choke points, custody middleware, and blind-sign failures
• Proofs & Verifiers — verifier-key setup collapse, field-domain drift, creation-time dead-on-arrival proof-backed objects, hidden gadget precondition omissions, nullifier field-alias replay versus one-right-many-nullifier construction mistakes, statement-binding failures, proof/effect mismatch, proof-backed tally / outcome-integrity binding failures, stale live-verifier ownership questions, committed effect-ledger drift, and residual proof-rail / exit-provenance review
• Specs — BIPs, BOLTs, LNURL/WebLN/NWC, EIPs/ERCs/CAIPs, and other reusable interface baselines that belong under references/standards rather than projects
• Fast pattern entry points:
  • Callbacks & reentrancy: Reentrancy, Read-only reentrancy, Callback-frame authority reuse, Callback-origin authentication failure, Safe-transfer receiver-callback reentrancy, and Collateral-membership desynchronization.
  • Oracle & market abuse: Oracle manipulation, Stale-price exploitation, Oracle source-independence failure, Minimum live-source threshold failure, LP-token oracle mispricing, MetaPool virtual-price normalization failure, liquidity desynchronization, roundtrip non-invariance, Protocol-authored market-state oracle failure, Vault strategy-path valuation manipulation, Protocol-native collateral fragility, share-price manipulation, First-deposit inflation, Inverse-price floor-to-zero, Unit normalization failure, AMM invariant scaling mismatch, and State-publication authority failure.
  • Lending, collateral & liquidations: Fresh-market initialization failure, Empty-market exchange-rate inflation, Supplier-index inflation, zero-share borrow inflation, Utilization-boundary failure, off-path state mutation, Oracle configuration failure, Migration trust-boundary failure, Counterfeit collateral admission, Solvency check bypass, Post-trade solvency validation bypass, Self-liquidation monetization, and Liquidation-auction liveness failure.
  • Accounting, issuance & claims: share-price manipulation (accounting lens), Balance-delta provenance failure, multi-entry token surface, Ambient payment-context reuse, reversible initialization semantics, Cross-module asset-denomination mismatch, deflationary-token accounting mismatch, First-deposit inflation, idempotency failure, redemption solvency asymmetry, Shared-standard entrypoint invariant drift, Transfer-time reward-checkpoint omission, Reward-index initialization failure, denominator-collapse reward amplification, Virtual-balance withdrawal mismatch, and State-publication authority failure.
  • Governance, admin & upgrades: Governance capture, Borrowable governance weight, vote-operator separation failure, Attack-funded governance extortion, Backstop-failure governance capture, governance-token neutrality failure, remnant-authority capture, Deprecation without deauthorization, Action-bundle non-commitment, mutable-code execution, Privileged upgrade abuse, Shared-code singleton retained-authority bricking, Storage-layout collision, re-initialization, and Mutable threshold-state self-bricking.
  • Bridges & crosschain: Bridge verification failure, default-value authenticity aliasing, Message-source authentication failure, locked-value mismatch, Proof-to-message binding failure, Verifier-input independence failure, Degraded-mode authenticity failure, Asset-identity registry poisoning, Cross-layer interpretation mismatch, Local mint-authority substitution, and Privileged message dispatcher abuse.
  • Operator compromise & custody: Signer-quorum compromise, Operator-boundary opacity, Authorized-action origination compromise, Blind-sign payload substitution, Stored-privileged-approval persistence, and Threshold-ceremony share leakage.
  • Approvals, wallets & integrations: Arbitrary-call token-approval drain, approval-rights exposure, approval synthesis, Trusted execution-envelope corruption, Account-confusion root-of-trust substitution, semantic-compatibility failure, Frontend-compromise approval phishing, debug-telemetry exfiltration, Software supply-chain compromise, and source-to-runtime artifact drift.
  • Proofs & verifiers: Curve-point validation failure, Validation-output nonconsumption, Bit-length precondition omission, Verification-key independence collapse, Public-input domain mismatch, Creation-time proof-usability failure, Nullifier canonicalization failure, public-input binding failure, Nullifier-derivation nondeterminism, Proof-backed outcome-integrity failure, and Proof-to-effects binding failure.
• Design-layer fast entry points: Callback frame truth, AMM callback counterparty recomputation and payer pinning discipline, Safe-read surface discipline, Collateral-admission lag and borrow-side quarantine, Borrowed-execution depth and post-fill solvency discipline, Debt-zero emergency exit discipline, Recursive-borrow suppression for fresh collateral, Effective-freshness reclassification and dormant-market quarantine, Bootstrap-state irreversibility and supply-floor design, Minimum-unit burn rounding and low-decimal asset discipline, Supplier-denominator integrity and thin-market fee socialization, Actual-balance and scaled-liquidity ledger coherence discipline, Borrowable-liquidity and deposit-ledger coherence discipline, Utilization-domain enforcement and supercritical-rate quarantine, Unexpected-balance quarantine and explicit recognition discipline, Sync, harvest, and cache-write authority discipline, Reward-recognition, presentation, and collateral-admission separation, Internal-mark publication quarantine and reserve-spend separation, Concentrated-liquidity boundary coherence and reverse-path discipline, Active-liquidity and idle-balance ledger coherence discipline, Multi-estimator monotonicity and selector-switch discipline, AMM invariant unit-consistency and fork-equivalence discipline, Backstop-sleeve solvency isolation and inherited-position trigger discipline, Vault-share truth, Per-deployment wrapper solvency independence discipline, Reserve-backed claim truth, Reward-entitlement identity and batch canonicalization, Root-object authenticity and trust-anchor recomputation discipline, Canonical payer identity and receipt-binding discipline, Unit-domain seam typing and explicit conversion discipline, Price-domain and reciprocal-range discipline, Reciprocal price normalization and nonzero-invariant discipline, Metapool LP normalization and path-equivalence discipline, Exit-right consumed-state binding, Bridge truth, Bridge message-membership exactness and minimal-proof-shape discipline, Bridge deposit truth binding, Bridge source-provenance bundle and authoring-surface discipline, Bridge canonical-path exclusivity and stale-authoring-surface deauthorization, Bridge route-local redeemability domain discipline, Bridge asset-identity admission and destination reservation discipline, Bridge typed-intent dispatch and control-plane separation, Bridge bounded release design, Bridge headroom provenance and exact-consumption discipline, Bridge verifier independence inventory and degraded-mode discipline, Treasury governance-token vote-neutrality discipline, Sentinel-lane separation and default-value deauthorization, Signer intent truth, Approval-funded route-authority truth, Operator-topology map and effective-threshold discipline, Operator continuity loss as immediate authority degradation, Post-authentication bounded-loss design, Proof-facing field-domain canonicalization, Creation-time proof usability and dead-on-arrival object prevention, Proof validation-output consumption and statement-binding discipline, Verification-key statement inventory and asset-reachability discipline, Proof-state object unification and indexed-binding discipline, Nullifier right-object canonicalization, Proof effect truth, Canonical outcome commitment and finalization discipline, Effect-ledger commitment, and Exit-right provenance binding.
• Operational rollout companions: Operator experimentation separation from live balance-sheet authority, Exit-only status signaling and downstream de-recognition, Machine-readable residual-status publication, Residual-status inheritance across aliases and successors, Partial successor independence and graduated residual-policy lifting, Incentive and market-making quarantine for partially independent successors, Residual-liquidity segregation and active-TVL hygiene, Oracle migration quarantine and canary design, Oracle independence inventory and degraded-mode discipline, Backstop-sleeve solvency isolation and inherited-position trigger discipline, Fresh-market seeding and activation discipline, Effective-freshness reclassification and dormant-market quarantine, Collateral canonical-asset proof bundle and issuer-authenticity discipline, Collateral-admission lag and borrow-side quarantine, Collateral membership truth as a single security object, Collateral liveness and right-consumption discipline, LP collateral weakest-leg unwind and same-window quarantine, Internal-mark publication quarantine and reserve-spend separation, Sync, harvest, and cache-write authority discipline, House-asset collateral quarantine and external-liquidity discipline, Wrapper semantic-price revocation and collateral de-recognition, Actual-receipt accounting and token-semantics admission discipline, Metapool LP normalization and path-equivalence discipline, Callback frame truth as a single security object, Temporary capability closure before external delivery, Privilege-stripped external execution and inventory-scoped trampolines, safe-read oracle interfaces, Delayed snapshots and same-block quarantine, Receiver-hook staged delivery and single-accounting ownership, Settlement envelope truth as a single security object, Request-origination lane separation and scoped shutdown discipline, Route commitment across callback frame and settlement envelope, Bridge truth as a single security object, Bridge message-membership exactness and minimal-proof-shape discipline, Bridge typed-intent dispatch and control-plane separation, Bridge proof-state sentinel separation and default-value discipline, Bridge semantic canonicalization and parser-agreement discipline, Bridge bounded release design, Bridge verifier independence inventory and degraded-mode discipline, Bridge deposit truth binding, Bridge source-provenance bundle and authoring-surface discipline, Bridge canonical-path exclusivity and stale-authoring-surface deauthorization, Bridge route-local redeemability domain discipline, Bridge asset-identity admission and destination reservation discipline, Proof-state object unification and indexed-binding discipline, Verification-key statement inventory and asset-reachability discipline, Trusted-setup finalization and verifier-family quarantine discipline, Exact production artifact attestation and rollback discipline, Exit-only residual-surface discipline, Concentrated-liquidity boundary coherence and reverse-path discipline, AMM invariant unit-consistency and fork-equivalence discipline, Wide-integer helper trust boundary and exact-overflow discipline, and Deprecation without deauthorization.
• Governance / authority design companions: Execution-envelope identity pinning, Post-authentication bounded-loss design, Privileged-action lane separation and ceremony escalation, Compromise-class authority rotation and residual-revocation discipline, Timelock action-bundle commitment, Constitutional electorate bounding and threshold-independence discipline, Governance backstop scope and intervention-latency discipline, Incident-response lane separation and exploit-tainted vote quarantine, Treasury governance-token vote-neutrality discipline, Decommissioning authority-extinguishment discipline, Exit-only residual-surface discipline, Implementation and singleton direct-call deauthorization, Storage-layout continuity and live-state interpretation discipline, and Live balance-sheet asset identity pinning.
• Lending / liquidation design companions: Fresh-market seeding and activation discipline, Effective-freshness reclassification and dormant-market quarantine, Supplier-denominator integrity and thin-market fee socialization, Actual-balance and scaled-liquidity ledger coherence discipline, Borrowable-liquidity and deposit-ledger coherence discipline, Utilization-domain enforcement and supercritical-rate quarantine, Unexpected-balance quarantine and explicit recognition discipline, Bootstrap-state irreversibility and supply-floor design, Migration cutover authenticity and single-record consumption discipline, Live balance-sheet asset identity pinning, Oracle migration quarantine and canary design, LP collateral weakest-leg unwind and same-window quarantine, Minimum-unit burn rounding and low-decimal asset discipline, Helper-path invariant reuse and fail-closed discipline, Collateral membership truth as a single security object, Collateral liveness and right-consumption discipline, Recursive-borrow suppression for fresh collateral, Debt-zero emergency exit discipline, borrower-separation discipline, Borrow-side concentration and short-cover discipline, Liquidation-capital provenance and keeper-competition assumptions, Backstop-sleeve solvency isolation and inherited-position trigger discipline, and Low-supply recovery and recapitalization discipline.
• Approval / signer design companions: Root-object authenticity and trust-anchor recomputation discipline, Canonical payer identity and receipt-binding discipline, Spender authority truth as a single security object, Approval-funded route-authority truth as a single security object, Market-role authenticity and cross-market token segregation, Signer intent truth as a single security object, Stored-privileged-approval expiry and revocation discipline, Request-origination lane separation and scoped shutdown discipline, Privileged-action lane separation and ceremony escalation, Compromise-class authority rotation and residual-revocation discipline, Post-authentication bounded-loss design, Hot-wallet operating-float and reserve-segmentation discipline, Threshold-ceremony proof completeness and fresh-signer exposure discipline, Replayable-secret non-observability and telemetry-exclusion discipline, Operator topology map and effective-threshold discipline, Canonical-domain runtime-byte integrity, Third-party runtime allowance and integrity pinning, and Exact production artifact attestation and rollback discipline.
• Reward / share-accounting design companions: Vault share truth as a single security object, Reserve-backed claim truth as a single security object, Unexpected-balance quarantine and explicit recognition discipline, Actual-balance and scaled-liquidity ledger coherence discipline, LP exit and next-quote balance-sheet coherence, Entrypoint equivalence under shared standards, Unsupported standard-verb revocation and fail-closed surface, Wide-integer helper trust boundary and exact-overflow discipline, Reward entitlement identity and batch canonicalization, Reward-flywheel initialization and checkpoint coherence, Reward-recognition, presentation, and collateral-admission separation, Sync, harvest, and cache-write authority discipline, Internal-mark publication quarantine and reserve-spend separation, Per-deployment wrapper solvency independence discipline, Exit-right consumed-state binding, Bootstrap-state irreversibility and supply-floor design, and Low-supply recovery and recapitalization discipline.
• Proof / verifier design companions: Proof validation-output consumption and statement-binding discipline, Helper-domain proof locality and output canonicalization discipline, Proof-element admission boundary discipline, Verification-key statement inventory and asset-reachability discipline, Proof-facing field-domain canonicalization discipline, Creation-time proof usability and dead-on-arrival object prevention, Proof-state object unification and indexed-binding discipline, Nullifier right-object canonicalization discipline, Trusted-setup finalization and verifier-family quarantine discipline, Exact production artifact attestation and rollback discipline, Exit-only residual-surface discipline, Proof effect truth as a single security object, Canonical outcome commitment and finalization discipline, one committed settled-effects object, and no ambient internal balance trust.

Entity and operator notes

• Entities — sparse notes for cases where the organization itself is the control surface, with grouped entry slices for wallet/custody operators, payments and ramp companies, chain-access and chain-ops vendors, security/compliance workflow entities, and foundation-versus-labs splits; current examples include 0xmacro, 0xteam, 21-analytics, netki, ackee-blockchain, audita, guardian-audits, quillaudits, the-bitcoin-company, cobo, coinbase, chainlink-labs, consensys, protocol-labs, warbler-labs, expanso, coincover, conio, coingate, coinkite, cometh, shift-crypto, cypherock, compass-labs, commonwealth-labs, guild, snapshot-labs, alluvial, figment, chorus-one, chaos-labs, chronicle-labs, block-analitica, blockful, block, zama, fhenix, shielded-technologies, sky-mavis, liminal, mixin-network, safe, sablier-labs, settlemint, reown, reservoir, ginco, gnosis-pay, finoa, foundation-devices, bluewallet, exodus, sparrow-wallet, specter-association, onekey, satochip, asigna, gridplus, gauntlet, avantgarde-finance, steakhouse-financial, llamarisk, stablelab, station70, curialab, ledger, satoshilabs, coolbitx, secret-key-labs, galoy, anchorage-digital, anchorwatch, acinq, alby, ambire, amboss, anypay, agora, aisa, zaprite, asterpay, arf, fewsats, xpay, alchemy, biconomy, pimlico, allium, astria, avail-technology, transpose, douro-labs, drift-labs, doublezero-foundation, alpen-labs, ark-labs, ankr, blend-capital, quicknode, tenderly, chainstack, chainbase, anza, drpc, conduit, caldera, risk-labs, ritual-labs, skip, layerzero-labs, abacus-works, bloxroute, boltz, bq-labs, baanx, babylon-labs, banxa, bvnk, nilos, noah, avian-labs, blockradar, bitnob, bitwave, bridge-xyz, chain, cybrid, cashramp, coinflow, copperx, bluerails, mesh, blindpay, brale, brink, openpayd, openfx, orbital, cryptoprocessing, rapyd, modern-treasury, dakota, daimo, depay, lyzi, dodo-payments, mugglepay, cryptorefills, mural-pay, request-finance, opentrade, openeden, hashnote, mountain-protocol, paxos, circle, noble, bitgo, hex-trust, safeheron, copper, fireblocks, blockdaemon, blocknative, blockscout, dune, goldsky, envio, bitquery, coin-metrics, l2beat, kaiko, lukka, nansen, blockaid, blockapex, blocksec, halborn, hacken, hashlock, slowmist, chainlight, blowfish, cyvers, fuzzland, fyeo, goplus-security, webacy, gelato, cantina, cd-security, bailsec, codespect, code4rena, cyfrin, sherlock, immunefi, blockstream, jan3, shocknet, synonym, trail-of-bits, least-authority, mixbytes, quantstamp, iosiro, coinfabrik, pashov-audit-group, oak-security, octane-security, asymmetric-research, adevar-labs, trm-labs, anchain-ai, chainalysis, chainpatrol, chainapsis, rabbyhub, crystal-intelligence, elliptic, global-ledger, merkle-science, scorechain, sec3, neodyme, veridise, second, sardine, security-alliance-seal, verifyvasp, verichains, chainsecurity, scam-sniffer, ottersec, certora, runtime-verification, zksecurity, x3-security, sigma-prime, sumsub, terminal-3, marketguard, metrika, spruceid, notabene, talos, trusta-ai, coinspect, finery-markets, shift-markets, taceo, inco, tatum, taurus, transak, transfi, guardarian, meso, triple-a, wert, paybis, swapped-com, paycrest, ramp-network, onramper, onboard, rain, reap, redotpay, relai, validation-cloud, stakewise-labs, kiln, komainu, everstake, twinstake, p2p-org, luganodes, launchnodes, jump-crypto, lightspark, lexe, lightning-labs, moonpay, halliday, mercuryo, monerium, megaeth-labs, moondance-labs, opennode, pouch-ph, coincorner, pocket-bitcoin, ibex, inxy-payments, swiss-bitcoin-pay, bitrefill, bull-bitcoin, byte-federal, strike, straitsx, stable-genius, stables, sphere, spritz, stripe, river, start9, umbrel, voltage, fedi, qr-wallet, wallet-of-satoshi, zbd, zoth, breez, yield-xyz, casa, nunchuk, muun, thirdweb, particle-network, theya, tiplink, backpack, cake-labs, espresso-systems, zodia-custody, turnkey, utila, dfns, fystack, dynamic, openfort, eigen-labs, fordefi, para, paradex, portal, privy, squads-labs, zerion, magic, stackup, passkeys-foundation, parfin, crossmint, venly, helius, magicblock, hexens, hiro, hypernative, hyperlane-foundation, hyperliquid-labs, hyper-foundation, hivemapper-foundation, golem-foundation, hummingbot-foundation, indexing-co, jito-labs, jito-foundation, ssv-labs, ssv-foundation, dv-labs, succinct-labs, risc-zero, nebra, syndica, solana-foundation, neynar, nethermind, o1-labs, npc-labs, archax, aquanow, bridgeport, areta, dinari, securitize, tokeny, unchained, zerohash, flashbots, offchain-labs, polygon-labs, uniswap-labs, openzeppelin, dedaub, informal-systems, numen-cyber, pessimistic-io, zellic, optimism-labs, optimism-foundation, royco-foundation, wormhole-foundation, world-foundation, tools-for-humanity, and mara

• Representative project↔company splits: ronin keeps the chain / bridge / developer-surface story separate from sky-mavis, which is the sharper note for validator-topology history, builder admission, and the branded distribution shell around Ronin; drift now stays on trading mechanics, keeper / JIT structure, and risk design, while drift-labs carries the first-party app, gateway / Swift tooling, and implementation-gravity boundary; solana-wallet-adapter now stays on app-side wallet middleware while anza isolates the named maintainer shell around Agave, docs, SDK/tooling packaging, and adapter stewardship.

Control, governance, and market structure

• Control Surfaces — where practical authority actually sits
• Permissions and Policy — who gets admitted, filtered, or overruled
• Routing and Defaults — who chooses paths, venues, or counterparties by default
• Value Capture Shifts — where rents move when interfaces or standards change
• Gauge Wars — bribing, vote-routing, and emission control markets
• Staking as Control Plane — stake as admission, coordination, or policy machinery
• Collateralized Money Markets — lending systems where risk routing matters more than surface branding

Wallet, session, and account-control stack

• Wallet and Custody Control Planes — shared custody, signer ops, embedded-wallet middleware
• Wallet Connectivity — connection layers between apps, wallets, and user sessions
• Wallet Session and Relay Rails — relay, session, and message transport underneath wallet UX

Payments and token movement

• Payment Auth — payment initiation, request signing, and machine-payments flows
• Crosschain Token Control Planes — bridge admission, token sovereignty, and multichain supply control