https://rheinaudit.com/research Web3 vulnerability disclosures, security research papers, and deep technical analyses from Rhein Audit. en Wed, 09 Sep 2026 20:48:17 GMT https://rheinaudit.com/research/aptos-hijack-bug https://rheinaudit.com/research/aptos-hijack-bug Sat, 04 Jul 2026 00:00:00 GMT TL;DR -- A stale type-tag cache in the Aptos Move VM lets a recycled StructNameIndex map to the wrong StructTag after a partial cache flush, enabling storage-level type confusion. An attacker aligns a look-alike struct onto a victim resource and reads/writes its storage slot -- draining vaults, stealing capabilities, and forging cross-chain messages. Severity: Critical. Research https://rheinaudit.com/research/polygon-bridge-forging-transaction-proofs https://rheinaudit.com/research/polygon-bridge-forging-transaction-proofs Wed, 04 Mar 2026 00:00:00 GMT This is a disclosure of a vulnerability in the Polygon Plasma bridge. The vulnerability has been fixed since July 2024 and the fix has been pushed to the vulnerable library as well. Research https://rheinaudit.com/research/solidity-compiler-bug-tstore-poison https://rheinaudit.com/research/solidity-compiler-bug-tstore-poison Wed, 18 Feb 2026 00:00:00 GMT TL;DR -- A cache key collision in the Solidity compiler's via-ir code generator causes delete on transient variables to emit sstore instead of tstore, or conversely causes persistent delete to emit tstore instead of sstore. The direction depends on function selector ordering -- neither direction is safe. Research