One finding from a real Zealynx engagement, one exploit autopsied at the line-of-code level, a tooling note, and what we shipped this week. Every issue, archived in full. Built for the engineers who will own the fix.
A vault can pass every line-level check and still hand an attacker a 2,080,000% APY print, because the bug was never in a line of code. It was in the accounting a decommissioned strategy left behind. This week: a dormant-component NAV finding, the Summer.fi autopsy that matches it, and the one Foundry invariant that catches both.
Read the issue →Weeks 01 and 02 were about a key that could spend and a key that could sign. This week the key does something worse: it replaces the contract. Humanity Protocol lost roughly $36M when three valid signatures upgraded a token proxy and minted 300M new tokens, and the audited logic never had a say.
Read the issue →A weekly view from inside the audit queue: one finding worth your attention, one exploit autopsied at the line-of-code level, a tooling note, what we published on the blog this week, and an Academy update.
Read the issue →A weekly view from inside the audit queue: one finding worth your attention, one exploit autopsied at the line-of-code level, a tooling note, what we published on the blog this week, and an Academy update.
Read the issue →One finding from a real engagement, one exploit autopsied like we would in a kickoff call, a tooling note, and what Zealynx shipped this week. Built for the engineers who will own the fix.