Public write-ups on the bugs, patterns, and protocols we audit. Engineer-to-engineer, no fluff.
Open the V3 pool contract and look for the price. It is not there. What is stored is the square root, in Q64.96, and that single choice is what makes the swap loop affordable.
Read
Concentrated liquidity gives 10,000 dollars the depth of 40 million. That one decision forced Uniswap V3 to abandon LP tokens, reserves, and compounding fees. Here is why.
Read
When LLMs can prepare or sign transactions, smart contract risk expands into prompt injection, policy drift, simulation mismatch, and wallet authority abuse.
Read
A builder focused Hyperliquid security checklist covering HyperBFT assumptions, HyperCore integrations, HyperEVM deployment risks, and pre audit launch gates before mainnet.
Read
A builder focused Hyperliquid security checklist covering HyperBFT, HyperCore, HyperEVM, order flow, liquidation, oracle, bridge, and pre audit risks before launch.
Read
EIP-7702 lets EOAs become smart contracts with one signature. Here are the 4 attack surfaces — phishing, delegate bugs, replay, ERC-4337 — auditors now check.
ReadOpen the V3 pool contract and look for the price. It is not there. What is stored is the square root, in Q64.96, and that single choice is what makes the swap loop affordable.
ReadConcentrated liquidity gives 10,000 dollars the depth of 40 million. That one decision forced Uniswap V3 to abandon LP tokens, reserves, and compounding fees. Here is why.
Read
Rebuild Compound V2 from scratch — cTokens, Comptroller, InterestRateModel, and liquidation logic. The second-most-forked DeFi protocol, understood end to end.
Read
A full smart contract audit costs $15k-$100k+. Here is an honest comparison of every option an underfunded web3 founder actually has in 2026: free tools, AI review, audit contests, bug bounties, time-boxed audit sessions, and when each one is enough.
Read
A senior auditor walks through what actually happens during a smart contract audit, week by week. Pre-audit prep, manual review, findings, fix verification, and final deliverables.
Read
The 2026 security timeline for Web3 protocols: when to audit at design, dev, pre-launch, and post-launch — plus real lead times, audit costs, and launch buffer rules.
ReadWhen LLMs can prepare or sign transactions, smart contract risk expands into prompt injection, policy drift, simulation mismatch, and wallet authority abuse.
Read
How to audit AI trading bots and onchain agents before prompt injection, wallet misuse, and market-facing automation turn into fund loss.
Read
Technical analysis of the largest crypto hack ($1.5B). How compromised frontend infrastructure enabled UI injection that turned blind signing into a total drain.
Read
The ERC-4626 inflation attack still drains vaults in 2026. See the deposit-donate math, real hacks (Cream, Sonne, Resupply), and the invariants that catch it.
Read
Most 2026 DeFi losses came from compromised signers, not buggy code. How multisig, timelocks, and MPC contain key compromise — lessons from Drift's $285M hack.
Read
How flash loans amplify oracle, donation, and reentrancy bugs into $200M+ DeFi exploits — Cetus, Penpie, KyberSwap, UwU Lend case studies plus defenses that hold.
Read
Free Discords, CTFs, audit contest platforms, bootcamps, and paid memberships compared. What each one actually gives a web3 developer, aspiring auditor, or protocol founder in 2026, what it costs, and how to choose.
Read
Most Web3 founders are technical and ship great code, then watch the protocol die to non-code problems. Tokenomics, fundraising, governance, regulatory, GTM — this is what kills teams.
Read
The 2026 OWASP Smart Contract Top 10 elevated business logic to #2 and added proxy & upgradeability at #10. Here's what changed and how to audit.
Read
How to learn Web3 from scratch: the right order to actually understand blockchains, wallets, DeFi, and scams, in a free 90-day path.
Read
A free, interactive Zealynx Academy course that teaches you to understand Web3 for real, crypto, DeFi, wallets, DAOs, scams, security, not memorize jargon.
Read
After 30+ audits, we kept seeing failures rooted in missing literacy, not missing code skill. So a security firm built a beginner course. Here's why.
Read
Identity theft cost Americans $43 billion in 2023. Learn how blockchain-based digital identity could fortify your finances, unlock new opportunities, and open global economic doors — with real-world results from Estonia's digital pioneer program.
Read
Learn how to prevent front-running in ERC20 smart contracts using safer allowance methods and secure coding practices. Protect your tokens from exploits.
Read
Discover how our team secured a top 5 position in the Cyfrin CodeHawks contest, finding critical vulnerabilities and earning a substantial reward in just two days
Read
How fuzz testing catches smart contract bugs that unit tests miss: Foundry invariant testing, property-based fuzzing, and real DeFi exploit examples — Zealynx Security.
Read
Discover how fuzz testing and formal verification enhance blockchain security. Deep dive into advanced techniques for detecting critical smart contract vulnerabilities.
Read
Learn how to prepare for a smart contract audit efficiently. Essential checklist for documentation, tests, and code quality to maximize audit productivity.
Read
Deep dive into Uniswap V2 Router's addLiquidity function line by line. Understand how liquidity is calculated, LP tokens are minted, and what risks liquidity providers face — from impermanent loss to smart contract vulnerabilities.
Read
Learn about overflow and underflow vulnerabilities in Solidity with real high and medium severity audit findings, code examples, and an exercise to practice.
Read
Deep dive into Liquity's Stability Pool, liquidation mechanics, and redemption logic — explained from the smart contracts. How LUSD absorbs debt, ETH gets redistributed, and Troves get redeemed.
Read
Learn how to prepare a security audit summary for an already deployed protocol. A practical walkthrough using the Juicebox Buyback Delegate audit.
Read
Deep dive into Liquity protocol's smart contracts: LUSD/LQTY tokens, Troves, borrowing mechanics, price feeds, and liquidation logic explained from the source code.
Read
Explore real-life examples of Denial of Service (DoS) attacks on smart contracts found in audit contests. Learn about DoS caused by underflow, gas limits, nonReentrant modifiers, external calls, and malicious receivers.
Read