Guardian · Chief Technology Officer
Daniel Gelfand
Daniel co-founded Guardian and leads its technology. He drove Guardian’s fuzzing research, the invariant work that now sits inside every audit.
Resource Hub
Articles by Daniel Gelfand
112 guides and explainers, newest first.
Pausable Contract Design: Roles, Scope and Who Can Unpause
What to Do When a Multisig Signer Is Compromised
Safe Multisig Monitoring: Owner, Module and Guard Alerts
USDC Blacklist and USDT Freeze Functions Explained
Synthetic and Delta-Neutral Stablecoin Risks Explained
Are AI-Generated Smart Contracts Safe? What Research Shows
EVMbench Explained: What It Says About AI Auditors
Binance October 10 Crash: Pricing, Depegs and the Cascade
LLM Pentesting Checklist for Crypto and Fintech Apps
OWASP Top 10 2025 Explained for Crypto and Fintech Web Apps
Webhook Security Best Practices for Crypto Payments
Secrets Management Best Practices for Crypto Companies
The THORChain Signing Exploit Explained
The Polymarket Hack Explained: A Third-Party Script
The SwissBorg Hack Explained: A Compromised Staking API
The Trust Wallet Extension Hack Explained
Web3 SDK Security Testing: How to Audit a Wallet SDK
Offchain Automation Pentest: Keepers, Relayers and Bots
Private Key Exposed on GitHub: What to Do in the First Hour
Malicious VS Code Extensions: GlassWorm and Crypto Theft
The Resolv USR Exploit Explained
The NEAR Intents Exploit Explained
Vulnerability Triage for a Critical Bug in Live Contracts
AI Trading Agent Security: Threat Model and Controls
Smart Contract Vulnerability Examples: Search 9,617 Findings
Infinite Mint Attacks: How Unbacked Tokens Get Minted
Underconstrained Circuits: The Most Common ZK Bug, Explained
Initializer Vulnerabilities and _disableInitializers
ERC-20 Vulnerabilities: Approve Races, Mint Bugs and Hooks
ERC-4626 Vulnerabilities: A Vault Security Checklist
Balancer Exploit Post-Mortem: How Rounding Drained V2 Pools
Token-2022 Extensions: The Security Risk Each One Adds
The Liquid Network Exploit Explained
The Cosmos EVM Exploit Explained: One Bug, Six Chains
Ledger Ethereum App Signing Flaw Explained
Linux Kernel CVE: Why Solana Validators Were Warned
The axios npm Compromise Explained
React2Shell (CVE-2025-55182) Explained
Next.js Middleware Bypass (CVE-2025-29927) Explained
Is Morpho Safe? A Security Review for Allocators
Is Hyperliquid Safe? A Security and Risk Breakdown
ZK Rollup vs Optimistic Rollup: What Each One Trusts
Restaking Risks: EigenLayer, Symbiotic and LRTs Explained
Ethereum Slashing Risk: Causes, Penalties and Prevention
Bad Debt in DeFi: How It Forms and Who Pays for It
Equity Perps Explained: How Stock Perps Work and Break
Auto-Deleveraging (ADL) Explained: How Perps Share Losses
Monad vs Ethereum: Contract Differences That Affect Security
Glamsterdam Upgrade: What Changes for Ethereum Security
Cross-Chain Bridge Audit: Scope, Timeline and Cost
Ownable vs AccessControl vs AccessManager in Solidity
OpenZeppelin Contracts v4 to v5: Can Live Proxies Upgrade?
Smart Contract CI/CD Pipeline: Foundry, Slither and Fuzzing
Solana Smart Contract Security: Best Practices for Anchor
Which Solidity Version Should You Use? A Security View
UUPS vs Transparent Proxy: Security Tradeoffs Compared
Foundry Invariant Testing: Handlers, Ghost Variables, Actors
Echidna vs Medusa vs Foundry: Which Fuzzer Should You Use?
Slither Tutorial: Static Analysis for Solidity Teams
Best Blockchain CTF Challenges for Aspiring Auditors
Move Smart Contract Security: Guarantees and Common Bugs
ERC-3643 vs ERC-1400: Choosing a Security Token Standard
HSM vs KMS for Crypto Signing Keys
The Drift Exploit: Durable Nonces and a 2-of-5 Council
Safe Multisig Statistics: 39 Safes Behind DeFi Admin Keys
DAO Governance Security Checklist
How to Verify a Safe Transaction Before Signing: 5 Steps
SEC Liquid Staking Guidance: Contract Conditions for LSTs
LayerZero OFT Security Checklist: OFTs and OFT Adapters
Deployed vs Audited Code: What Bytecode Verification Found
Next.js Versions on Crypto Frontends: Known Critical Flaws
Daml Smart Contract Audit: What Reviewers Check on Canton
Solana Smart Contract Audit: Cost, Timeline and Checks
Crypto Exchange Pentesting: What a Real Assessment Covers
Best AI Tools for Smart Contract Auditing in 2026
Browser Extension Pentest Guide for Crypto Wallets
dApp Frontend Supply Chain Security: npm Attack Mitigation
Assumed Breach Pentest: Starting From a Compromised Laptop
Web Application Pentesting for Crypto and Fintech
Permit2 Phishing: How One Signature Drains a Wallet
Kelp DAO Hack: The rsETH Exploit and What It Means for LRTs
Access Control Vulnerabilities in Smart Contracts: The Data
Business Logic Vulnerabilities in Smart Contracts
Legacy Smart Contract Risk: How to Retire Old Deployments
Best Smart Contract Language for Security: What Audits Show
OWASP Smart Contract Top 10 for 2026, With Real Exploits
Perp DEX Security: The Attack Surface of Perpetual Exchanges
DeFi Security: Risks and Controls by Protocol Type
Vault Curator Risk: What Stream Finance Taught DeFi
LayerZero vs Wormhole: Verification Models Compared
LayerZero DVN Configuration: A Security Guide After Kelp
Is Aave Safe? Security, Bad Debt and the Safety Module
EIP-7702 vs ERC-4337: Which Account Abstraction Is Safer?
L2BEAT Stages Explained: What Rollup Stage 0, 1 and 2 Mean
Liquid Staking Risks Explained
Pre-Mainnet Security Checklist for Smart Contract Teams
Smart Contract Change Management for Live Protocols
Lending Protocol Audit Checklist: 40 Money Market Checks
Smart Contract Vulnerability Scanners: What Free Tools Miss
Formal Verification vs Fuzzing vs Audit: Which Do You Need?
Custom EVM Audit: What to Review in a Forked or Modified EVM
Secure Foundry Deployment Scripts: Keys, Proxies and Checks
Perp DEX Audit Checklist: 40 Checks for Perpetual Exchanges
x402 Facilitator Security Checklist
Crypto Exchange Withdrawal Security: From Request to Signing
DeFi Protocol Due Diligence Checklist for Regulated Firms
Multichain Stablecoin Deployment Verification Checklist
Web3 Pentest Findings in DeFi Backends, Keepers and Cloud
Crypto Wallet Penetration Testing: What to Test
Wallet Frontend Security: Signing Interfaces After Bybit
Telegram Mini App Security: A Pentesting Checklist
