Security research and reports from QED.https://qedaudit.io/https://qedaudit.io/blog/poseidon-collision/https://qedaudit.io/blog/poseidon-collision/QED constructed a full 28-round collision for the Poseidon1 Collision challenge by choosing the MDS matrix as a function of the round constants.Mon, 14 Sep 2026 00:00:00 GMThttps://qedaudit.io/blog/brilliantly-simple/https://qedaudit.io/blog/brilliantly-simple/QED found CVE-2026-19174, an integer overflow vulnerability in V8 that allows arbitrary code execution without a heap sandbox bypass.Sat, 05 Sep 2026 00:00:00 GMThttps://qedaudit.io/blog/earn-your-stripes/https://qedaudit.io/blog/earn-your-stripes/Sharing large blocks efficiently means rebuilding them from smaller pieces. In the worst (and common) case, block recovery was limited to one core and repeated an expensive calculation. We now split that work across cores and skip the duplicate step, making it nearly 4x faster.Thu, 13 Aug 2026 00:00:00 GMThttps://qedaudit.io/blog/celestia/https://qedaudit.io/blog/celestia/Celestia has integrated QED into its development process for continuous security assessment.Mon, 03 Aug 2026 00:00:00 GMThttps://qedaudit.io/blog/ethereum-foundation/https://qedaudit.io/blog/ethereum-foundation/The Ethereum Foundation engaged QED to build specialized security agents for the Ethereum protocol.Wed, 10 Jun 2026 00:00:00 GMThttps://qedaudit.io/blog/thorchain-loophole/https://qedaudit.io/blog/thorchain-loophole/QED identified two critical vulnerabilities in THORChain that put $47.3M in pooled assets at risk.Mon, 01 Jun 2026 00:00:00 GMThttps://qedaudit.io/blog/commonware/https://qedaudit.io/blog/commonware/A joint look at how QED helps Commonware fix subtle vulnerabilities before it reaches production.Thu, 07 May 2026 00:00:00 GMThttps://qedaudit.io/blog/dydx/https://qedaudit.io/blog/dydx/A string-comparison bug in dYdX v4 could let an attacker rewire perp oracles and steal against $1.2M of open interest.Wed, 06 May 2026 00:00:00 GMThttps://qedaudit.io/blog/two-bugs-in-jolt/https://qedaudit.io/blog/two-bugs-in-jolt/QED found a soundness bug and a completeness bug in a16z's zkVM, Jolt.Tue, 05 May 2026 00:00:00 GMThttps://qedaudit.io/blog/tachyon/https://qedaudit.io/blog/tachyon/A six-year-old CometBFT time-warp bug left 40+ chains exposed to consensus failure and put more than $600M in assets at risk.Sun, 22 Feb 2026 00:00:00 GMT