A sell tax that reconciled a liquidity pool’s reserves mid-transfer, and the property that catches it regardless of the mechanism.

Arcadia lost $3.5M to a call it let its caller shape. How a custom static detector catches that pattern on every commit, before the code ships.

A custom detector pinpoints the single Euler function that shipped without the solvency guard every other path enforced.

A live balance read let borrowed votes pass as real stake. How live-state fuzzing catches Beanstalk’s $182M drain before execution.