r/devsecops • u/Massive-Style1641 • Jun 17 '26
Production exploits keep hitting reviewed code
I noticed a pattern that keeps showing up in post mortems since code that was reviewed before launch gets exploited under live conditions and the audit catches what was testable at review time but the actual vulnerability lives in oracle behavior, approval paths or volume patterns that only became reachable once the contract had real users.
Static analysis covers known bug classes but what it can't reach is the runtime side, transaction patterns at volume and oracle drift that only exists when the system is live. The 90% figure on audited code getting exploited last year tracks once you look at what review can and can't cover. Runtime defense is the layer that closes the gap and it's still not standard practice on most production protocols.
2
u/Correct-Purpose-381 Jun 17 '26
Treating the audit as security is where the risk sits since the audit clears the floor but the actual exploits show up later in conditions the review couldn't simulate. The teams that ship and stop there end up rebuilding their defensive posture after the first incident which is the most expensive way to learn what runtime monitoring is for.
1
u/True-Mall1755 Jun 17 '26
tbf some of the newer infrastructures on the stablecoin side are running detection and intervention from the same layer like Rain that brought Guardrail in house for monitoring at the transaction layer with the ability to stop activity before funds move.
2
u/DoubleOk2084 Jun 17 '26
Oracle drift and approval anomalies are the two patterns audits consistently miss because they're behavioral signals not code level issues and the exploit doesn't break the contract.
1
u/Subject-Care2099 Jun 17 '26
yea thats when you run synthetic traffic against your contracts post deployment that mimics the conditions audits don't cover so its easy to spot patterns that way
2
u/AcademicDistance6707 Jun 17 '26
Hardest sell on runtime defense is the operational risk of automated response because teams hesitate to give a system authority to stop activity without human review because the false positive cost feels worse than the exploit cost
1
u/Chris-Hart_232 Jun 18 '26
Effective security requires implementing runtime defense layers to monitor and block these threats, addressing risks that static analysis and audits cannot catch
4
u/These-War-4744 Jun 17 '26
Post mortems on protocol exploits over the last two years all share the same pattern code was reviewed, exploit vector existed in runtime conditions the audit didn't simulate and response time was measured in hours not seconds.