The Trail of Bits Bug List: What Breaks Crypto in 2026
Two profiles told you who Trail of Bits is. This is the bug list: the smart-account, Uniswap v4, and rounding flaws it hunts in 2026, plus the quantum clock now ticking on every wallet.
In April 2026, the world’s best-known smart-contract auditor did something strange for a firm that earns its keep reading Solidity: it broke Google. Google’s Quantum AI group had published a zero-knowledge proof arguing that a first-generation quantum computer could crack elliptic-curve cryptography in roughly nine minutes. Trail of Bits took apart the Rust code behind that proof, found memory-safety and logic bugs in it, and forged a proof of its own that claimed an even smaller quantum circuit than Google had. You can read the firm’s own write-up of how it did it. The stunt was not about embarrassing Google. It was a reminder of what Trail of Bits does for a living: it finds the exact, specific ways that real code fails.
Trail of Bits usually gets described two ways. One is flattering: crypto’s most respected code auditor, the shop that ships the open-source tools everyone else runs. The other is a warning: the firm whose stamp did not stop Balancer or Bunni from being drained. Both are true, and neither tells you what the auditor actually looks for when it opens a codebase. This article is the missing third view. Call it the bug list: the concrete, named classes of flaw that Trail of Bits spent 2026 documenting, tooling against, and hunting in client code, from smart-account footguns to Uniswap v4 hooks to rounding leaks, plus the one slow-moving threat that could eventually break every wallet on every chain at once.
Read enough of the firm’s 2026 output, its public blog, its audit reports, its research, and a pattern jumps out. The same small set of mistakes keeps draining money, and they are boringly repeatable. Dan Guido, who co-founded Trail of Bits in 2012, has a line about exactly this. Speaking to Decential, he said, “I don’t ever want to find the same bug twice. That was the motivation behind creating a static analysis framework and a verification tool.” The list below is what taking that seriously looks like in practice.
| Bug class | What actually goes wrong | Where Trail of Bits flagged it in 2026 |
|---|---|---|
| Broken access control | Privileged functions callable by anyone | ERC-4337 accounts; unguarded v4 hook callbacks |
| Rounding and accounting leaks | Precision loss and unit mismatches that pass the checks | Dimensional-analysis research; Balancer, Bunni |
| Smart-account footguns | Signature, validation and delegation errors | Six mistakes in ERC-4337 |
| Hook logic failures | Callbacks that leak value or trap funds | Seven patterns in Uniswap v4 hooks |
| Keys, intent and economics | The code is correct; the humans or incentives are not | Threat modeling and post-mortems |
| The quantum horizon | Elliptic-curve signatures that Shor’s algorithm breaks | trailmix circuits; post-quantum Python |
The firm that turns exploits into a checklist
Trail of Bits was founded in New York in 2012 and has grown into one of the few security firms that treats blockchain as one practice among several, sitting alongside cryptography, application security, AI and machine learning, and low-level systems work. It is privately held, funded by paid engagements and government research contracts rather than venture rounds, and it has published more than 600 public audit reports over its life. That volume is the point. Every engagement feeds a library of failure modes, and the firm turns that library into free, open-source tooling under its Crytic organization.
Three tools carry most of the weight. Slither is a static analyzer for Solidity and Vyper that flags known-bad patterns in seconds. Echidna is a property-based fuzzer: you write down an invariant that should always hold, and it hammers the contract with random inputs trying to break it. Medusa, written in Go, is the newer, parallel, coverage-guided successor that uses Slither’s output to steer where it fuzzes. None of this replaces a human reading the code, but it clears the repetitive findings so the humans can chase the subtle ones.
In 2026 the firm added a layer on top: it went, in its own telling, from about 5 percent internal AI adoption to using AI on almost every engagement, with certain reviews surfacing roughly 200 candidate bugs a week against about 15 the old way, and about a fifth of all reported findings starting life as an AI discovery before a human verifies them. Trail of Bits laid out the whole transformation in a March 2026 post. The result is that the bug classes below get found faster and more often, which is exactly why the same names keep recurring in the firm’s public writing.
Bug class one: who is actually allowed to call this?
The oldest bug in the book is still among the most expensive: a function that changes state or moves money, with nothing checking who is allowed to call it. In a normal contract that means a missing owner check. In the newer designs Trail of Bits reviewed all year, it takes fresh shapes, but the root cause never changes.
Take smart accounts. Under the ERC-4337 account-abstraction standard, your wallet is itself a contract, and a shared EntryPoint contract is supposed to be the only thing allowed to trigger its execute function. Forget to enforce that, and, in the firm’s blunt framing, anyone can drain the wallet. The same mistake shows up in Uniswap v4 hooks, where an external callback that skips caller verification lets an attacker invoke it directly with malicious parameters. Different ecosystems, identical flaw.
Access control also fails in quieter ways: functions that trust a user-supplied address, contracts that assume a caller is the protocol when it is not, and initialization routines that a stranger can front-run. This is the class of bug that automated tooling catches best, because the pattern is legible, and it is also the class Guido has been loudest about. “They have reinvented every security issue that we eliminated from modern languages like Rust and Go and Swift,” he told Decential of Solidity and the EVM. Access control is exhibit A.
Bug class two: rounding leaks and the physics trick that catches them
If access control is the loudest bug, rounding is the sneakiest. Smart contracts do integer math, so every division throws away a remainder. Individually those fractions are dust. Accumulated across thousands of crafted transactions, they become a drain. Two of 2026’s most discussed DeFi losses, Balancer and Bunni, came down to precisely this, and the flaws slipped through multiple audits because, in isolation, each rounding step looked harmless.
Trail of Bits’ answer is a technique borrowed from physics: dimensional analysis. The idea, laid out in a March 2026 post, is that every quantity in a DeFi formula has a unit, tokens, shares, prices, liquidity, and both sides of an equation must carry the same units. You cannot add token A to token B, and you cannot compare a raw share count to a token amount, any more than you can add meters to seconds. When the units do not line up, there is a bug. The firm gives a clean example: a formula that computes price as a token amount divided by liquidity is dimensionally wrong, because liquidity is itself the square root of a product of two balances, so the result comes out as the square root of a price rather than a price. It also points to a real vulnerability in production code where decimals were passed to a function expecting asset amounts, a mismatch the method flags on sight.
Because this is tedious to do by hand, Trail of Bits released a Claude plugin that runs the analysis automatically, and it recommends that teams annotate variables with their dimensions the way the Reserve Protocol already does. This is the through-line of the whole bug list: take a class of exploit that keeps happening, then build a repeatable check that makes it hard to ship again. Readers weighing how safe on-chain credit really is can see the same rounding-and-accounting risk mapped across lending markets in our 2026 DeFi lending risk map.
Bug class three: six ways to break a smart account
Account abstraction is the biggest change to how Ethereum wallets work in years, and it is arriving fast through ERC-4337 and the newer ERC-7702 delegation path shipped in the Pectra upgrade. It also multiplies the ways a wallet can go wrong, because the wallet is now a program. After auditing dozens of these accounts, Trail of Bits published six recurring mistakes, and they read like a syllabus for how account-abstraction money gets stolen.
| Mistake | What goes wrong | The fix |
|---|---|---|
| Incorrect access control | execute is not restricted to the EntryPoint, so anyone can call it and drain the wallet | Require the caller to be the EntryPoint |
| Incomplete signature validation | Gas fields are left out of the signed data, letting a bundler inflate costs and bleed ETH | Sign the full userOpHash, which binds every field |
| State changes during validation | Storage written during validation can be clobbered before execution runs | Keep validation read-only where possible |
| ERC-1271 signature replay | Signatures not bound to one account and chain can be reused elsewhere | Use EIP-712 typed data that pins account and chain |
| Reverts do not save you | A failed operation still pays gas, and postOp reverts do not undo payments, draining paymaster pools | Validate strictly before spending gas |
| Old accounts meet ERC-7702 | EOA delegation lets a stranger front-run initialization | Require the caller to be the account itself |
The unifying lesson is that a smart account has to distrust its own plumbing: the bundler that relays its operations, the paymaster that fronts its gas, and even a future upgrade path it does not control yet. If you are choosing a wallet in this new world, our guide to how account-abstraction wallets actually work in 2026 covers what these designs change for ordinary users.
Bug class four: the seven ways a Uniswap v4 hook bleeds
Uniswap v4 let developers attach custom code, called hooks, that runs at set points in a swap or a liquidity change. Hooks are why v4 is powerful, and they are also a new attack surface bolted onto a battle-tested core. In a July 2026 study of dozens of audit findings and public reports, Trail of Bits distilled seven recurring failure patterns. Crucially, the firm notes that the Cork and Bunni incidents, together more than 20 million dollars in losses, did not come from the Uniswap core or the PoolManager at all; they came from the authorization and accounting logic teams built around hooks.
| Hook failure pattern | What goes wrong |
|---|---|
| Unguarded callbacks | Hook functions skip caller checks, so attackers call them directly |
| Untrusted pool selection | User-supplied pool identifiers are trusted, routing funds through attacker pools |
| Accounting value leaks | Wrong delta signs, rounding, or mixed balances drain value while the settlement check still passes |
| Wrong hook timing | Logic meant for beforeSwap runs in afterSwap on stale state |
| Mismatched permission bits | The hook address encodes callbacks that no longer match the implemented functions |
| Blocked user exits | Non-essential callback code reverts and traps users who want to withdraw |
| Cross-callback state changes | Shared storage shifts between beforeSwap and afterSwap, corrupting accounting |
The dangerous common thread is the third one. The PoolManager enforces a single global rule, that all currency deltas settle to zero at the end of a transaction, and developers assume that if that check passes, the books are balanced. They are not. A hook can leak value into its own internal accounting and still settle to zero at the pool level, which is why Trail of Bits ships both a builder checklist (gate every callback, allowlist pools, label every balance, fuzz adversarial inputs) and an auditor checklist that asks the same seven questions from the attacker’s side.
The bugs no audit will ever catch
Here is the uncomfortable part of the bug list: the most costly losses of the past two years were mostly not code bugs at all. Industry trackers keep landing on the same split. Smart-contract exploits are the majority of incidents by count, but a minority of the dollars. The money leaves through compromised keys, social engineering, malicious insiders, and infrastructure that sits outside any audit’s scope. The Bybit theft that defined 2025 was a signing-interface compromise, not a Solidity flaw. An audit reads the contract; it does not read the mind of the engineer who will later approve a poisoned transaction.
Then there is intent. A protocol can be flawless line by line and still be gutted by an attacker who uses it exactly as written, through a flash-loaned governance vote, an oracle nudged for a single block, or an economic design that pays out more than it takes in. Alexander Urbelis, chief information security officer at ENS Labs, put it plainly to CoinDesk: “The bugs that drain treasuries often turn on intent and adversarial incentives.” Those are judgment calls, not checklist items, and they are why threat modeling, not just code review, is the harder half of the job.
This is also the honest limit of the AI wave. Automated tools are superb at the legible classes above and useless at guessing an adversary’s incentives. David Schwed, chief operating officer at security firm SVRN, has the line of the year on it: “‘Claude, audit my smart contract, make no mistakes’ is not a security program.” The tools raise the floor; they do not remove the need for someone who thinks like an attacker.
When the mapmaker misses the road
A firm that publishes a bug list should be judged by its own failures, and Trail of Bits has two well-documented ones. Balancer, drained for more than 100 million dollars across nine chains in November 2025, is the sharper case. Back in 2021 the firm had actually flagged the underlying rounding weakness, in a finding it labeled undetermined because it could not confirm the flaw was exploitable under the pool settings of the day. The same arithmetic weakness resurfaced years later in related code and was exploited. To its credit, Trail of Bits published a retrospective owning the miss, arguing that 2021-era threat models were fixated on stolen keys and access control, not arithmetic edge cases.
Bunni is the other. Trail of Bits had flagged the lack of a systematic approach to rounding; the team applied a fix, but it did not cover the exact edge case an attacker later used to drain roughly 8.4 million dollars in September 2025, after which the project shut down for good. The two cases are the same coin: at Balancer a real finding was under-rated, at Bunni a real finding was under-fixed. Suhail Kakar, a developer-relations lead at TAC Blockchain, drew the broad lesson after Balancer: “This space needs to accept that ‘audited by X’ means almost nothing. Code is hard, DeFi is harder.” An audit is a snapshot of the code that existed on the day it ran, nothing more.
The new frontier: auditing the quantum attack itself
The bug classes so far live inside smart contracts. The last few live underneath them, in the cryptography every chain assumes will hold. This is where 2026 got genuinely strange. In April, Google’s Quantum AI group published a zero-knowledge proof of an optimized quantum circuit, work meant to demonstrate, credibly and verifiably, how few resources a future quantum computer would need to break elliptic-curve cryptography. Trail of Bits treated the proof the way it treats any other codebase: it looked for bugs.
It found them. Google’s Rust prover used an unsafe block with unchecked deserialization, which let Trail of Bits feed in an out-of-range operation type that still performed a real quantum operation while slipping past the counter meant to tally the expensive gates. A second flaw let the same qubit act as both input and output, something a real reversible quantum circuit can never do. Exploiting both, Trail of Bits forged a valid-looking proof claiming a circuit of about 1,164 qubits, undercutting the roughly 1,175 qubits in Google’s own optimized design. The proof was, of course, a fake, which was exactly the point: a zero-knowledge proof is only as trustworthy as the code that generates it.
This matters beyond a research spat. As quantum-cryptanalysis claims move from academic papers into verifiable proofs that could inform real migration timelines, someone has to check that the proof software is sound. Finding a memory-safety bug in a Rust prover is the same skill as finding a reentrancy bug in a vault; only the stakes and the vocabulary differ. It is also a preview of the threat in the next section, because the whole exercise was about counting, precisely, how close the world is to breaking the signatures that guard your coins.
Q-Day and the clock on every private key
Bitcoin, Ethereum, and nearly every other chain sign transactions with elliptic-curve cryptography over a curve called secp256k1. That math is safe against today’s computers and defenseless against a large enough quantum one, because Shor’s algorithm can recover a private key from its public key. The industry’s shorthand for the moment such a machine exists is Q-Day. No machine can do it now. The unsettling trend is how quickly the estimated cost is falling.
In June 2026, Trail of Bits released trailmix, a set of five quantum circuits for the single most expensive step in the attack, elliptic-curve point addition, and set a new low-qubit record at around 1,066 logical qubits, as covered in this reporting. Because the attack runs that step billions of times, a cheaper step means a smaller and faster quantum computer can eventually do the job, and the published record has kept dropping as other researchers pile in. Each tick is one more step toward Q-Day.
For holders the danger has a name: harvest now, decrypt later. A public key is exposed the moment it appears on-chain, and coins sitting in addresses that have already revealed their public keys, through address reuse or the old pay-to-public-key format that Satoshi-era coins use, are the ones a future attacker could target first. Nothing about Taproot changes the underlying curve, as our Taproot scorecard details; Schnorr signatures are elegant, but they still ride on secp256k1. A handful of chains already sign with quantum-resistant schemes, but retrofitting Bitcoin or Ethereum is a governance problem as much as a cryptographic one.
Post-quantum cryptography is already shipping
The good news is that the defense is standardized and, increasingly, installed. In 2024 the United States standards body NIST finalized the first post-quantum algorithms, among them ML-KEM for key establishment and ML-DSA for digital signatures, both based on lattice problems that Shor’s algorithm does not shortcut. The remaining work is unglamorous: getting those algorithms into the libraries the world actually runs.
That is where Trail of Bits spent part of 2026. With funding from the Sovereign Tech Agency, it added ML-KEM and ML-DSA support to pyca/cryptography, described in a June 2026 post, doing the Rust bindings, the cross-backend interface, and the tests. The library is not niche: it is the eleventh most-downloaded package on PyPI, pulling well over a billion downloads a month and underpinning tools such as Ansible, Certbot, and paramiko. Putting quantum-resistant primitives one install away for the entire Python ecosystem is the sort of quiet infrastructure work that decides whether a migration actually happens.
Governments are now forcing the pace. Trail of Bits notes that a June 2026 White House directive told US federal systems to adopt post-quantum key establishment by the end of 2030 and post-quantum signatures by the end of 2031. Crypto has no such mandate and no such deadline, which is precisely the gap worth watching: the value at stake is measured in trillions of dollars, and the chains securing it move slower than the agencies now sprinting to re-key.
Why bug bounties are the other half of the answer
If an audit is a snapshot, a bug bounty is the live camera. The two are complements, not substitutes. An audit brings deep, expert attention to the code as it exists on a given date; a standing bounty keeps thousands of independent eyes on it indefinitely, and pays only when someone finds something real. The strongest 2026 security programs run both, plus continuous fuzzing with tools like Echidna and Medusa between formal reviews.
The economics have grown up. Top programs now advertise seven-figure and even eight-figure maximum payouts, and research on long-running bounties suggests that nearly every program left open for years eventually surfaces a paid critical bug, evidence that the flaws were there all along, waiting. We break down what those headline numbers really mean, and what actually gets paid, in our look at bug bounty payouts in 2026. The takeaway for any protocol reading its own bug list: the goal is not a clean audit report to frame on the wall, it is layered coverage that assumes the report missed something.
Who actually regulates any of this?
Almost no one, in the way people assume. In the United States there is no licensing board for smart-contract auditors, no equivalent of the accounting profession’s oversight body, and no rule from the Securities and Exchange Commission (SEC) requiring a protocol to be audited before it holds user funds. The SEC’s crypto agenda in 2026 is about which tokens are securities and who must register, not about setting code-review standards. If an auditor misses a bug, the sanction is reputational, not regulatory.
Nor does the picture change much offshore. Europe’s MiCA regime and its operational-resilience rules reach the centralized service providers, the exchanges and custodians, but neither mandates a line-by-line audit of a protocol’s Solidity, and a fully decentralized protocol can fall outside the perimeter entirely. The same free-floating accountability applies to the compliance layer that sits on top of crypto; our explainer on the FATF Travel Rule and VASPs shows how thin the global framework still is. For now, the market polices audit quality by reputation, and reputation is exactly what a published bug list is meant to build.
What builders and holders should do with this list
For builders, the practical value of Trail of Bits’ 2026 output is that it converts abstract fear into concrete checklists. Before shipping a smart account, walk the six ERC-4337 mistakes. Before shipping a Uniswap v4 hook, walk the seven patterns and, above all, do not trust the settlement invariant to catch your internal accounting. Annotate your variables with their dimensions so a reviewer can spot a unit mismatch. Run Slither on every commit, write real invariants for Echidna or Medusa, and treat a fuzzing campaign as non-negotiable rather than a luxury. None of this is exotic; all of it is public and free.
For holders, the list is a lens for judging risk. A protocol that publishes its audit reports, its findings, and its fixes is telling you more than one that flashes an auditor’s logo. Ask whether the audit is recent, whether the exact code you are using was in scope, and whether a bug bounty backs it. Assume that keys and human error, not clever math, are the likeliest way you lose funds, and secure your own accordingly. And keep half an eye on the quantum horizon: it will not arrive next week, but the migration will take years, and the projects thinking about it now are the ones you will want to be holding when Q-Day stops being a research topic.
The through-line from a rounding leak to a quantum circuit is a single discipline: name the failure, build the check, and never find the same bug twice. That is not a slogan. It is a business model, and in an industry that lost billions to preventable mistakes, it is also the closest thing crypto has to an immune system.
Frequently Asked Questions
What does Trail of Bits actually do?
Trail of Bits is a New York security firm founded in 2012 that audits code across blockchain, cryptography, AI, and low-level systems. In crypto it reviews smart contracts for clients, publishes free open-source tools such as Slither, Echidna, and Medusa, and researches emerging threats like quantum attacks on elliptic-curve cryptography.
What are the most common smart-contract bugs in 2026?
Broken access control, rounding and accounting leaks, and logic errors in newer designs like ERC-4337 smart accounts and Uniswap v4 hooks. Trail of Bits documented six recurring ERC-4337 mistakes and seven recurring v4 hook failure patterns in 2026, most of them variations on trusting the wrong caller or losing value to precision errors.
If a protocol is audited, is it safe?
No. An audit checks the code that existed on the day it ran; it cannot catch compromised keys, insider actions, economic design flaws, or code added after the review. Balancer and Bunni were both audited and still exploited. Treat an audit as one layer alongside bug bounties, continuous fuzzing, and good operational security.
Can quantum computers steal my Bitcoin?
Not yet. No quantum computer today can break the secp256k1 signatures that secure Bitcoin and Ethereum, but research in 2026, including Trail of Bits’ trailmix circuits, keeps lowering the estimated hardware needed. Coins in addresses that have already exposed their public keys would be the first targets on Q-Day, so quantum-resistant standards like ML-KEM and ML-DSA are being deployed now.
Are Trail of Bits’ tools free to use?
Yes. Slither, Echidna, Medusa, and much of the firm’s guidance, including its dimensional-analysis plugin and its ERC-4337 and Uniswap v4 checklists, are published free and open source. Developers can run them on their own code before ever hiring an auditor.
By Anneke de Vries, senior security correspondent at HOGE Wire.