Researches

Article by @Zer0day_sec | www.0daysec.xyz Target: STON.fi DEX v2 - contracts/pool.fc Researcher: Zeroday Sec Disclosure URL: https://www.0daysec.xyz/research/ston-fi-protocol-fee Full POC: https://gist.github.com/Zee99y/7143ff27791222d45f3de8486f3f49dc Submitted Severity: Major (ZerodaySec) - Classified Minor (CertiK SkyShield) Status: Disputed, Unpatched as of disclosure date Disclosure Authorization Public disclosure of this finding was expressly authorized by STON.fi via CertiK SkyShield in written email correspondence dated April 17, 2026. STON.fi requested that their official response accompany the disclosure. That response is included in full under Official Response & Rebuttal below. Executive Summary A logical flaw in STON.fi DEX v2’s protocol fee collection mechanism permanently blocks fee withdrawal in any pool experiencing unidirectional swap flow. The AND-gate condition in protocolfee.fc requires both token fee buckets to be nonzero simultaneously before any collection is permitted, a condition that is never satisfied in pools where swaps flow predominantly or exclusively in one direction. ...

Article by @Zer0day_sec | www.0daysec.xyz The current market volatility, already being dubbed the dawn of the “Aipocalypse” by some analysts, marks more than a routine correction. It signals a profound structural shift in the foundations of global finance. In May 2026, Anthropic launched a suite of 10 specialized financial AI agents, now deeply embedded in the core workflows of JPMorgan Chase, Goldman Sachs, Moody’s, and other major institutions. These agents, powered by the recently released Claude Opus 4.7, are functioning as a de facto financial operating system. Moody’s has embedded its entire risk and ratings platform directly into Claude as a native app via Model Context Protocol (MCP), giving AI instant, auditable access to data on more than 600 million companies. Wall Street’s plumbing is being rewritten in real time. Legacy data providers are increasingly reduced to back-end feeds, while autonomous agents draft credit memos, run KYC checks, audit statements, synthesize filings, build pitchbooks, and execute trades with minimal human oversight. This is not incremental automation, it is the rapid replacement of human judgment at the highest levels of finance. And the risks this shift introduces are unlike anything regulators or traditional risk models were built to handle. Historical Echoes: Lessons from Past Crises History offers sobering precedents. The Great Depression (1929-1939) was triggered by speculative stock market bubbles fueled by margin buying, followed by the 1929 crash. ...

Welcome to Research by Zer0day. Here I will share all my qualified work, as permitted by both local and international laws. Follow for updates on X. Stay tuned. The zero-day hunter-finder.

Article by @Zer0day_sec | www.0daysec.xyz We have seen what AI brought to Web3 security. Both sides of it. On the positive side: automated scanners that detect exploits in real time, fuzzing tools that surface edge cases no human reviewer would catch, AI-assisted auditing that lets experienced researchers move faster and cover more ground. The stack is better. The tooling is sharper. The best security researchers in the space have a genuine force multiplier in their hands. On the negative side: AI exploit agents that fork mainnet, run a deposit, check if the math breaks, and do it across thousands of protocols per day for pennies. The window between misconfiguration and exploitation has collapsed from months to hours. April 2026 proved it. ZetaChain, YieldCore, Singularity Finance, Scallop—none were sophisticated attacks. All were assumption failures. All were found and exploited faster than any human team could respond. AI changed the threat landscape. It did not break the underlying cryptography. But… Quantum computing will. What Q-Day Actually Means...