Public write-ups on the bugs, patterns, and protocols we audit. Engineer-to-engineer, no fluff.
1.7 million possible ticks and the swap loop cannot scan them. One storage read, a mask, a bit scan. And one division that behaves differently for negative ticks.
Read
How much did a position earn while in range, over months of crossings, with no loops and one checkpoint? V3 answers in two subtractions by storing the wrong side on purpose.
Read
Every division in SqrtPriceMath decides where the lost fraction goes. V3 answers the same way every time: the pool wins. Get one flag backwards and you have built a faucet.
Read
A builder focused Hyperliquid security checklist covering HyperBFT assumptions, HyperCore integrations, HyperEVM deployment risks, and pre audit launch gates before mainnet.
Read
A builder focused Hyperliquid security checklist covering HyperBFT, HyperCore, HyperEVM, order flow, liquidation, oracle, bridge, and pre audit risks before launch.
Read
EIP-7702 lets EOAs become smart contracts with one signature. Here are the 4 attack surfaces — phishing, delegate bugs, replay, ERC-4337 — auditors now check.
Read1.7 million possible ticks and the swap loop cannot scan them. One storage read, a mask, a bit scan. And one division that behaves differently for negative ticks.
ReadHow much did a position earn while in range, over months of crossings, with no loops and one checkpoint? V3 answers in two subtractions by storing the wrong side on purpose.
ReadEvery division in SqrtPriceMath decides where the lost fraction goes. V3 answers the same way every time: the pool wins. Get one flag backwards and you have built a faucet.
Read
A full smart contract audit costs $15k-$100k+. Here is an honest comparison of every option an underfunded web3 founder actually has in 2026: free tools, AI review, audit contests, bug bounties, time-boxed audit sessions, and when each one is enough.
Read
A senior auditor walks through what actually happens during a smart contract audit, week by week. Pre-audit prep, manual review, findings, fix verification, and final deliverables.
Read
The 2026 security timeline for Web3 protocols: when to audit at design, dev, pre-launch, and post-launch — plus real lead times, audit costs, and launch buffer rules.
Read
When LLMs can prepare or sign transactions, smart contract risk expands into prompt injection, policy drift, simulation mismatch, and wallet authority abuse.
Read
How to audit AI trading bots and onchain agents before prompt injection, wallet misuse, and market-facing automation turn into fund loss.
Read
Technical analysis of the largest crypto hack ($1.5B). How compromised frontend infrastructure enabled UI injection that turned blind signing into a total drain.
Read
The ERC-4626 inflation attack still drains vaults in 2026. See the deposit-donate math, real hacks (Cream, Sonne, Resupply), and the invariants that catch it.
Read
Most 2026 DeFi losses came from compromised signers, not buggy code. How multisig, timelocks, and MPC contain key compromise — lessons from Drift's $285M hack.
Read
How flash loans amplify oracle, donation, and reentrancy bugs into $200M+ DeFi exploits — Cetus, Penpie, KyberSwap, UwU Lend case studies plus defenses that hold.
Read
Free Discords, CTFs, audit contest platforms, bootcamps, and paid memberships compared. What each one actually gives a web3 developer, aspiring auditor, or protocol founder in 2026, what it costs, and how to choose.
Read
Most Web3 founders are technical and ship great code, then watch the protocol die to non-code problems. Tokenomics, fundraising, governance, regulatory, GTM — this is what kills teams.
Read
The 2026 OWASP Smart Contract Top 10 elevated business logic to #2 and added proxy & upgradeability at #10. Here's what changed and how to audit.
Read
How to learn Web3 from scratch: the right order to actually understand blockchains, wallets, DeFi, and scams, in a free 90-day path.
Read
A free, interactive Zealynx Academy course that teaches you to understand Web3 for real, crypto, DeFi, wallets, DAOs, scams, security, not memorize jargon.
Read
After 30+ audits, we kept seeing failures rooted in missing literacy, not missing code skill. So a security firm built a beginner course. Here's why.
Read
Five systemic vectors targeting AI trading bots — adversarial ML, data poisoning, prompt injection, API exploits, supply chain compromise — with strategic mitigation.
Read
How prompt injection drains AI-controlled DeFi vaults. Freysa and AiXBT exploits analyzed, EVMbench data, and defense architecture for autonomous agents.
Read
How attackers exploit DAO governance with flash loans, EVM opcode injection, and quorum exhaustion — plus audit strategies and defense architectures.
Read
Your complete guide to EthCC 2026 in Cannes. Key dates, side events, networking tips, and how Web3 builders can make the most of the conference.
Read
How attackers exploit oracle price feeds in DeFi using flash loans, AMM imbalances, and governance subversion — with defense patterns for protocol architects.
Read
Learn how to defend your DeFi protocol from sandwich attacks and MEV extraction with PBS, encrypted mempools, intent architectures, and Uniswap v4 hooks.
Read
ERC-4337 account abstraction introduces programmable trust boundaries that break assumptions baked into decades of wallet security thinking. Here's where teams get it wrong.
Read![EthCC[9] in Cannes: Which Security Tracks Actually Matter for Protocol Teams](/_next/image?url=%2Fpost%2Fethcc-security-guide%2Fcover.png&w=3840&q=75&dpl=dpl_8cE6AxXpnqFCP16MmkF2UFsZmjPu)
A developer-focused guide to EthCC[9] in Cannes — which security tracks, ZK sessions, and side events matter most for protocol teams shipping on EVM and Solana.
Read
DNS hijacks, supply chain attacks, and UI social engineering bypass smart contract security entirely. Learn how attackers exploit web apps to drain DeFi protocols and how to stop them.
Read
MiCA enforcement is live and NCAs are issuing licenses now. If your codebase isn't audit-ready, your CASP application isn't ready either. Here's exactly what you need to fix before you request a quote.
Read
Real pricing from an auditor who sets the quotes. Auditor-day math, what moves your price up or down, and what you actually pay for in a security review.
Read
Compare ERC-3643 and ERC-1400 for RWA compliance. See identity checks, partition tradeoffs, ACT risk, forced transfers, and when each token standard fits.
Read