Security research

Security Research.

Public write-ups on the bugs, patterns, and protocols we audit. Engineer-to-engineer, no fluff.

Filter
Showing 12 of 110

All research.

When to audit a smart contract: The 2026 security timeline
Audit OperationsApr 27, 2026·26 min

When to audit a smart contract: The 2026 security timeline

The 2026 security timeline for Web3 protocols: when to audit at design, dev, pre-launch, and post-launch — plus real lead times, audit costs, and launch buffer rules.

Read
How to Build Uniswap V2 From Scratch (Line by Line, 207 Tests)
Zealynx NewsApr 24, 2026·18 min

How to Build Uniswap V2 From Scratch (Line by Line, 207 Tests)

Build Uniswap V2 from scratch, guided, line by line. Rebuild the Factory, Pair, Router, and Library contracts until all 207 automated tests pass.

Read
How to Scope a Smart Contract Audit: What Auditors Need
Audit OperationsApr 23, 2026·23 min

How to Scope a Smart Contract Audit: What Auditors Need

Smart contract audit scoping guide. Seven deliverables auditors need, nSLOC pricing benchmarks, and the Rekt Test — cut your quote 15–30%.

Read
Quadratic Funding Explained: Ethereum Security QF Round and Zealynx Academy
Zealynx NewsApr 23, 2026·14 min

Quadratic Funding Explained: Ethereum Security QF Round and Zealynx Academy

Quadratic funding rewards supporter count over donation size. TheDAO Fund's 500 ETH Ethereum Security QF round explained, and why Zealynx Academy joined.

Read
Zealynx Academy Is Public: Build, Audit, and Launch Web3 Protocols
Zealynx NewsApr 23, 2026·20 min

Zealynx Academy Is Public: Build, Audit, and Launch Web3 Protocols

Zealynx Academy opens today. A hands-on platform for Web3 founders to rebuild real protocols from scratch, shadow-audit forks, build AI auditors, and launch.

Read
Post-audit security: why the audit is a commit hash, not a security posture
Audit OperationsApr 22, 2026·21 min

Post-audit security: why the audit is a commit hash, not a security posture

Audits attest to a commit hash, not protocol safety. Learn how monitoring, invariants, runbooks, and OpSec close the gap — with Euler, Nomad, Ronin, and Radiant case studies.

Read
Yearn vault security: V2 vs V3 architecture, exploits, and defense patterns
DeFi Protocol AnalysisApr 20, 2026·16 min

Yearn vault security: V2 vs V3 architecture, exploits, and defense patterns

Yearn V2 and V3 vault architecture, exploit case studies (yDAI, yUSDT, Cream), and defense patterns every DeFi auditor and integrator must know.

Read
Base OP Stack Security Audit: 29 Checks EVM Equivalence Hides
Smart Contract SecurityApr 13, 2026·23 min

Base OP Stack Security Audit: 29 Checks EVM Equivalence Hides

29-point Base L2 audit checklist: block timing exploits, address aliasing, dual gas fees, bridge vulnerabilities, sequencer threats, and fault proof risks.

Read
Safeguard: Analysis of Customer Agent Orchestration System
Adversarial & AI SecurityApr 12, 2026·26 min

Safeguard: Analysis of Customer Agent Orchestration System

Understand the Architecture and Security Layers of a Customer Agent Orchestration System

Read
Layer 2 security under the hood: proof systems, upgrade keys, and what actually protects your funds
Smart Contract SecurityApr 9, 2026·17 min

Layer 2 security under the hood: proof systems, upgrade keys, and what actually protects your funds

Compare Arbitrum, Optimism, and Polygon zkEVM security models. Fraud proofs, ZK validity proofs, upgrade multisigs, and sequencer risks — a data-driven L2 guide.

Read
Why AI security needs pentesting, red teaming, and audits together
Adversarial & AI SecurityApr 7, 2026·20 min

Why AI security needs pentesting, red teaming, and audits together

Pentesting finds bugs, red teaming tests defenses, audits prove compliance. Learn why AI security demands all three integrated into one TEVV lifecycle.

Read
How to Harden an MCP Server Before It Becomes a Master Key to Your Infrastructure
Adversarial & AI SecurityApr 1, 2026·21 min

How to Harden an MCP Server Before It Becomes a Master Key to Your Infrastructure

Secure your MCP servers against prompt injection, credential theft, and supply chain attacks. A practical hardening guide for identity, transport, and runtime.

Read