Methodology, without the fog
Security work is only useful when its claims can be checked. This is the standard Nexus Trinity uses for reviews, research, and public writing.
Deployed code is the starting point
When a system is live, we begin with verified on-chain source and resolve proxies to their implementations. Repository code is useful context, but it is not assumed to be the code that holds funds.
A finding needs a proof
Candidate issues are tested on a local fork under the conditions that matter. If an exploit path cannot be demonstrated, it is not presented as a confirmed finding.
Impact comes from the system
We look past isolated patterns to accounting, authorization boundaries, oracle assumptions, upgrade paths, and how components behave when composed.
The report must be usable
Each confirmed issue includes the affected code, the required conditions, a runnable reproduction, impact reasoning, and a concrete remediation path.
What has to survive before something is called a finding
A pattern that looks like a bug is not a finding. Every candidate issue is checked against this sequence, in order, before it is written up. Most fail somewhere along the way — that is the point.
- 01Not already known. Checked against prior disclosures and known-issue lists first. A duplicate is not a finding, no matter how it's phrased.
- 02Stated as a falsifiable claim. Condition, impact, and mechanism named explicitly. “This might be exploitable” is not a claim.
- 03Backed by cited code. The exact file and line, not a paraphrase of what the code probably does.
- 04Executed, not theorized. For findings involving real fund loss, the proof of concept runs against a fork of the real deployed state — a real transaction either succeeds or it doesn't. Findings where that doesn't apply, like a privilege check with no fund-loss path, are labeled as such, not silently skipped.
- 05Repeated. Run twice, same starting conditions. A result that isn't identical both times is treated as noise, not a bug.
- 06Priced. Real profit after gas, fees, and slippage, measured from the fork execution itself. A confirmed exploit that isn't currently profitable is still reported — labeled honestly as unprofitable at current gas prices, not dropped.
- 07Attacked. Before anything is written up, we try to break the claim ourselves — the missing precondition, the admin control, the guard that stops it.
- 08Reproducible by someone else. Documented well enough that a second person can confirm it without asking us anything.
What a review is not
- —A guarantee that code has no defects, now or after it changes.
- —A replacement for operational controls, monitoring, or a responsible upgrade process.
- —A severity spreadsheet detached from a working reproduction.
Responsible disclosure
Public research is limited to public, verified source. If a credible issue is found, it is reproduced locally and shared privately with the responsible team before any public discussion. Nexus Trinity does not interact with live contracts.