When a smart contract has a bug, the code can't be patched — it's already live on-chain, and funds are already at risk. This post maps the main vulnerability categories, what recovery options actually exist, and how the security ecosystem has developed in response.