Mariano SalazarJune 16, 2026
Delegatecall does not move money: the subtle detail that triggered a critical *Infinite Spend* bug in Aurora Bridge
> How a misinterpretation of `msg.value`, combined with `delegatecall`, put the Aurora bridge's economic invariant at risk, and how an auditor's early discovery prevented a multi-million-dollar exploit.
If you are looking for a security audit for your protocol, feel free to contact us through our website seclat.xyz.
You can also find more Web3 security content on our blog.