Smart contract and protocol risk, taxonomised: the exploit classes, the dated incident record, what audits catch and what they miss. Sourced post-mortems, no threat-intel theatre.