Can’t Afford a Smart Contract Audit? 7 Options | Zealynx
Compare seven realistic security options when a full smart contract audit is out of budget, from free tools and AI review to senior audit sessions.
Security research
Security Research.
Public write-ups on the bugs, patterns, and protocols we audit. Engineer-to-engineer, no fluff.
Editor's pick
This month
Latest.
A Uniswap V3 Position Is a Hash and Five Numbers
There is no LP token in the V3 core. Fees are a debt, not a compounding balance. And the order of two lines decides whether anyone earns anything at all.
Read
AI Agent Wallet Security: 5 Ways Someone Empties It (and the Fix for Each)
An AI agent gave away 3 billion tokens because someone asked it to translate Morse code. The five ways an agent's wallet gets emptied, each shown on a local chain with a simulated agent, and the fix for each in code.
Read
WebSocket Authentication Is a Retention Boundary
A comparative study of WebSocket credential carriers, URL logging, browser constraints, and safer handshake authentication designs.
ReadCategory / research-articles
See all in Research Articles Research Articles.
WebSocket Authentication Is a Retention Boundary
A comparative study of WebSocket credential carriers, URL logging, browser constraints, and safer handshake authentication designs.
Read
When Operator Approval Stops Meaning Consent
A comparative study of NFT operator authority, approval scope, caller identity, revocation, and the controls that preserve holder consent.
Read
ERC-20 Transfers Need Three Proofs, Not One
A comparative study of ERC-20 transfer failures across custody, call success, and protocol accounting, anchored in the Bastion review.
ReadCategory / smart-contracts
See all in Smart Contract Security Smart Contract Security.
GENIUS Act Stablecoin Security: 5 Things Your Contract Must Get Right
The GENIUS Act asks every US dollar stablecoin for 1:1 reserves and the ability to comply with lawful orders. Five ways a stablecoin contract fails those demands, each shown on a local chain, with the fix in Solidity.
Read
Hyperliquid Security Checklist for Builders: HyperBFT, HyperCore, HyperEVM Risks Before Mainnet
A builder focused Hyperliquid security checklist covering HyperBFT assumptions, HyperCore integrations, HyperEVM deployment risks, and pre audit launch gates before mainnet.
Read
Hyperliquid Security Checklist for Builders: HyperBFT, HyperCore, HyperEVM
A builder focused Hyperliquid security checklist covering HyperBFT, HyperCore, HyperEVM, order flow, liquidation, oracle, bridge, and pre audit risks before launch.
ReadCategory / protocol-deep-dives
See all in DeFi Protocol Analysis DeFi Protocol Analysis.
A Uniswap V3 Position Is a Hash and Five Numbers
There is no LP token in the V3 core. Fees are a debt, not a compounding balance. And the order of two lines decides whether anyone earns anything at all.
Read
Floor Is Not Truncation: The Uniswap V3 TickBitmap
1.7 million possible ticks and the swap loop cannot scan them. One storage read, a mask, a bit scan. And one division that behaves differently for negative ticks.
Read
Fee Growth Outside: The Uniswap V3 Trick Nobody Explains Well
How much did a position earn while in range, over months of crossings, with no loops and one checkpoint? V3 answers in two subtractions by storing the wrong side on purpose.
ReadCategory / audit-ops
See all in Audit Operations Audit Operations.
Our AI Pipeline Finds Criticals Hiding in Plain Sight
How Zealynx's semi-autonomous AI finds unique Critical and High bugs in crowded audit competitions — 2nd of 98 on Quantus, plus the honest losses.
ReadCan’t Afford a Smart Contract Audit? 7 Options | Zealynx
Compare seven realistic security options when a full smart contract audit is out of budget, from free tools and AI review to senior audit sessions.
Read
What Happens During a Smart Contract Audit: Week-by-Week Process
A senior auditor walks through what actually happens during a smart contract audit, week by week. Pre-audit prep, manual review, findings, fix verification, and final deliverables.
ReadCategory / adversarial-security
See all in Adversarial & AI Security Adversarial & AI Security.
AI Agent Wallet Security: 5 Ways Someone Empties It (and the Fix for Each)
An AI agent gave away 3 billion tokens because someone asked it to translate Morse code. The five ways an agent's wallet gets emptied, each shown on a local chain with a simulated agent, and the fix for each in code.
Read
x402 Security: 5 Ways a Paid API Gets Drained (and the Fix for Each)
One signed x402 payment, sent 20 times at once, bought 20 premium responses. The five ways a paid x402 endpoint gets drained, each shown on a local chain, with the fix in code.
Read
When LLMs Sign Transactions: AI-Driven Smart Contract Threat Model
When LLMs can prepare or sign transactions, smart contract risk expands into prompt injection, policy drift, simulation mismatch, and wallet authority abuse.
ReadCategory / web3-attack-vectors
See all in Web3 Attack Vectors Web3 Attack Vectors.
The Asset You Price Is Not Always the Asset You Release
Demex's bridge released approximately US$191,929 while its withdrawal guard recorded US$10.47. The failure shows why bridge limits must price the destination asset actually leaving custody.
Read
ERC-4626 inflation attack: how it works and how to stop it
The ERC-4626 inflation attack still drains vaults in 2026. See the deposit-donate math, real hacks (Cream, Sonne, Resupply), and the invariants that catch it.
Read
Signer compromise: why clean audits don't stop key hacks
Most 2026 DeFi losses came from compromised signers, not buggy code. How multisig, timelocks, and MPC contain key compromise — lessons from Drift's $285M hack.
ReadCategory / industry
See all in Industry and Compliance Industry and Compliance.
Web3 Security Communities in 2026: Where Developers, Auditors, and Founders Actually Level Up
Free Discords, CTFs, audit contest platforms, bootcamps, and paid memberships compared. What each one actually gives a web3 developer, aspiring auditor, or protocol founder in 2026, what it costs, and how to choose.
Read
The Web3 Founder's Survival Guide: Everything No Engineering Curriculum Teaches
Most Web3 founders are technical and ship great code, then watch the protocol die to non-code problems. Tokenomics, fundraising, governance, regulatory, GTM — this is what kills teams.
Read
OWASP Smart Contract Top 10 2026: changes and audit guide
The 2026 OWASP Smart Contract Top 10 elevated business logic to #2 and added proxy & upgradeability at #10. Here's what changed and how to audit.
ReadCategory / zealynx-news
See all in Zealynx News Zealynx News.
New to Web3? The Exact 90-Day Path We'd Give a Complete Beginner
How to learn Web3 from scratch: the right order to actually understand blockchains, wallets, DeFi, and scams, in a free 90-day path.
Read
Introducing Your First 90 Days in Web3: A Free, Guided Path to Actually Understand the Space
A free, interactive Zealynx Academy course that teaches you to understand Web3 for real, crypto, DeFi, wallets, DAOs, scams, security, not memorize jargon.
Read
Why a Smart Contract Audit Firm Built a Free Beginner Web3 Course
After 30+ audits, we kept seeing failures rooted in missing literacy, not missing code skill. So a security firm built a beginner course. Here's why.
ReadShowing 12 of 173
All research.
A Uniswap V3 Position Is a Hash and Five Numbers
There is no LP token in the V3 core. Fees are a debt, not a compounding balance. And the order of two lines decides whether anyone earns anything at all.
ReadAI Agent Wallet Security: 5 Ways Someone Empties It (and the Fix for Each)
An AI agent gave away 3 billion tokens because someone asked it to translate Morse code. The five ways an agent's wallet gets emptied, each shown on a local chain with a simulated agent, and the fix for each in code.
ReadWebSocket Authentication Is a Retention Boundary
A comparative study of WebSocket credential carriers, URL logging, browser constraints, and safer handshake authentication designs.
ReadGENIUS Act Stablecoin Security: 5 Things Your Contract Must Get Right
The GENIUS Act asks every US dollar stablecoin for 1:1 reserves and the ability to comply with lawful orders. Five ways a stablecoin contract fails those demands, each shown on a local chain, with the fix in Solidity.
Readx402 Security: 5 Ways a Paid API Gets Drained (and the Fix for Each)
One signed x402 payment, sent 20 times at once, bought 20 premium responses. The five ways a paid x402 endpoint gets drained, each shown on a local chain, with the fix in code.
ReadWhen Operator Approval Stops Meaning Consent
A comparative study of NFT operator authority, approval scope, caller identity, revocation, and the controls that preserve holder consent.
ReadThe Asset You Price Is Not Always the Asset You Release
Demex's bridge released approximately US$191,929 while its withdrawal guard recorded US$10.47. The failure shows why bridge limits must price the destination asset actually leaving custody.
ReadERC-20 Transfers Need Three Proofs, Not One
A comparative study of ERC-20 transfer failures across custody, call success, and protocol accounting, anchored in the Bastion review.
Read
When a Safe View Becomes an Unsafe Settlement Input
A comparative study of context-sensitive balance views, vote-escrow transfer guards, and economic settlement invariants.
ReadOur AI Pipeline Finds Criticals Hiding in Plain Sight
How Zealynx's semi-autonomous AI finds unique Critical and High bugs in crowded audit competitions — 2nd of 98 on Quantus, plus the honest losses.
Read
When Every Check Passes but a Protocol Is Underbacked
A comparative study of transaction-level backing failures, from YadaCoin and public audit findings to the Opyn exploit and MISO disclosure.
ReadFloor Is Not Truncation: The Uniswap V3 TickBitmap
1.7 million possible ticks and the swap loop cannot scan them. One storage read, a mask, a bit scan. And one division that behaves differently for negative ticks.
Read