Adding liquidity to Uniswap V3 has three cases, and only ONE of them touches the pool's global liquidity variable. That variable means "active at the current tick". A position whose range does not contain the current tick contributes nothing to it. Update it in all three cases and the swap math divides by liquidity that is not there.

The function that drained a $197M lending protocol was added AFTER one of its audits. It was there to fix a different bug. So ten audits across six firms isn't the story. The story is that the thing which killed it arrived after the reviewing had finished, and nothing in the process looked at it again. Your re-audit trigger matters more than your audit count.

If a firm quotes a fixed price without asking to see the code, that number describes their pipeline, not your protocol. It costs nothing to watch for and it's the cleanest signal in the process. Two more from the lesson: engage 4-6 weeks BEFORE code freeze, not at it, and send invariants with the request rather than waiting to be asked.

Microsoft published a study saying developers using coding agents merged around 24% more PRs. I understand the doubts about using PRs as a metric. More code does not necessarily mean more value. But in my case, quantity does matter. I have an agent working every day on SEO, performance and CRO across my websites. For the first few months, I reviewed its PRs manually. After some time, it earned enough trust to automate this kind of work. Before having this, I know what happened because I already had the websites. I was unable to find the time to even add new audit reports, let alone regularly improve SEO, performance or conversions. Now I have three websites being maintained and improved continuously. So yes, more merged PRs can actually be a good metric when the task is well scoped and the model is good at it. Those improvements otherwise simply wouldn't happen. And honestly, for this type of PR, I think the quality can already be as good as, or potentially even higher than, a junior developer working on it. I wouldn't have trusted it on the first day. But after months of reviewing its work, it earned the automation.

I learned this by operating long-lived agents: memory needs provenance, not just content. A recalled note can be stale, transformed or attacker-shaped. Before any external action, I recheck the exact destination and parameters instead of trusting recalled context. That sink-time check limits what poisoned memory can unlock. xitter.cf/ZealynxSecurity/status…

A week inside Zealynx Insiders. I want to share these weekly because the value of a membership should be visible in what people actually do inside it, not in a list of promises on a landing page. WHAT MEMBERS WORKED ON One member spent the week auditing Venus-specific risk and bad-debt logic, moving from contract walkthroughs into manually validating hypotheses around auctions, recovery flows, and accounting behavior. Another started the Velodrome shadow audit and changed his process after our sessions. Instead of reading the codebase first and running AI tools afterward, he began learning the system while validating AI-generated leads against the code. Sammed continued developing Oscillon, his dynamic-fee mechanism for stable pairs. His reported backtest uses 118,000 real USDe swaps with out-of-sample validation, comparing 50.5% LP capture under a static setup with 73.6% using Oscillon. These are not presented as results caused by the membership. They are real pieces of work members shared while inside it. WHAT I BROUGHT INTO THE ROOM This week I ran two sessions around a four-day Velodrome shadow audit. In the kickoff, we opened the protocol cold, mapped its actors and economic flows, compared Pair.sol with Uniswap V2, and identified where Velodrome’s changes from Solidly create new audit surface. The companion session became a practical discussion about AI-assisted auditing: running independent hunters, separating hunting from triage, reviewing one issue at a time, maintaining a reusable rules repository, and using automation to create more time for manual code reading rather than pretending to replace it. I also released Your First 90 Days with Solidity. It contains 28 checkpoints across five acts, using 30 real contract files from seven repositories. The objective is not to teach people to type Solidity from a blank page. It is to make them capable of reading unfamiliar production code and judging code produced by a machine. We also continued the Concept Lab with practical exercises around audit readiness and related security concepts. The first engagement review showed that the current format is generating little discussion, so the next iteration needs a lower-friction, more project-specific response. That last part matters too. Membership value is not “I published more content.” It is creating an environment where people work on real systems, expose their reasoning, receive useful pressure, and leave with a clearer next action. That is what I am trying to build with Zealynx Insiders.

In Uniswap V2 you send tokens, then call mint, and the pair works out what arrived. V3 cannot do that. What you owe depends on the price at the moment your transaction executes, so you cannot know it in advance. So the pool computes what you owe, calls YOU back, and then checks its own balance grew.

Four things move an audit quote between $40K and $100K. Scope. Complexity. How much context you hand over. Whether your code is frozen when they start. Three of the four are yours. Teams negotiate the price and ignore the three levers that actually change what they get.

A freshly deployed Uniswap V3 pool has observation cardinality 1. One observation. Which means it has effectively no TWAP at all. Read observe on an arbitrary pool without checking cardinality first and you get a spot price wearing a costume. Real exploits have walked through that door.

Which of your external functions is worth the most to steal from? Most founders can't answer that, and it's an afternoon of work. List every external function. Next to each write one number: the max someone could extract by calling it in a way you didn't intend. Sort descending. 47 rows in the worked example. Three were a problem.

Season 2 of Zealynx Audit Grants closes tonight, 23:59 UTC. Last call, and the whole thing in one place. — What's on the table One protocol gets its smart contract audit 100% covered. Two get 50%. Builder grants cover 25% for the rest of the round. Over $100,000 in total. It's a subsidy on a real engagement at our standard rate of $6,000 per auditor per week. Not a discount code, not a junior team, not a trimmed scope. Recipients get the same founder-led, senior-only audit our paying clients get, and every report publishes in full when the engagement completes. — How it's scored Out of 100, published before applications opened, unchanged mid-round. 45 — protocol merit. Auditable code, frozen scope, real tests, a genuine security need, a credible path to users. 40 — product engagement. Earnable before I read a line of your code. 15 — independent builder. Solo founder or no priced round, and a team choosing its own auditor. Your bugs are not scored against you. The grant exists to find them. — What happened last time Eight protocols applied. Eight received a grant. Six chains, four continents, no VC money. There were no rejections at all, and every applicant got an individual decision with the reasons. — If your draft is open, submit it. Thirty minutes if your scope is ready. Winners announced October 11. grants.zealynx.io/grants/sea…

I’ve started moving some of the work I was doing with Hermes directly to the OpenAI app. Why? Because maintaining all of this by myself is kind of a pain. I used OpenClaw before and at some point I had to migrate. During that process I lost some data, scripts and context. Now I have Hermes, which is very powerful, but I still need to care about the storage, keeping things running and all the small things around it. It takes time. With OpenAI I don’t have to worry about that right now. I can just continue the work there and keep the context. Of course I am aware of the consequences. They have access to my data, I depend more on them, I have less control and so on. I would not move everything there. But honestly, for many work things, keeping the context without having to maintain all the infrastructure is starting to make so much more sense. And now OpenAI is adding durable sessions, sandboxes, computer use, subagents, scheduled work and this new thing they call Dots. I still don’t know exactly what I will do with Dots, but I wonder how will I be able to use or integrate them in my everyday work. It feels a bit funny after spending so much time building my own agent systems, but maybe for some things I just don’t want to maintain another system anymore.

I expanded Shadow Arena around one lesson from auditing forks: familiarity with the base protocol is leverage, but only if you use it to isolate the delta. When I know the original mechanism, I can ask sharper questions: • which invariant changed? • which old assumption no longer holds? • where did new accounting or authority enter? That is why I connected the Arena to the protocol-building tracks. You can build Uniswap, Compound, Yearn or Liquity first, then test that understanding against real forks from public contests. There are now 20 ranges: academy.zealynx.io/shadow-ar…

NEAR Intents disclosed a loss of around $3.8M caused by a bug between its contract and the Omni deposit and withdrawal infrastructure. The full postmortem is not out yet, so it is too early to say exactly what failed. But I do not think the problem is that intents make crosschain actions look simple. Crypto and Web3 are difficult enough already. If an intent lets someone say what they want to do without understanding every contract, bridge and step involved, that is useful. Most users should not need to know all of that. For me, the important part is that the complexity is hidden from the user, but not hidden from the people who need to review it. The code should be public and reviewable. If some parts are not, the documentation should at least explain which systems are involved, what they do and what assumptions users are depending on. Monitoring detected the unusual activity and the system was paused, which is good. It still did not prevent the loss. I am curious to read the postmortem. Until then, I would not blame simplification itself. Making something easier to use is fine. Making its dependencies impossible to inspect is a different thing.

Uniswap V3's initialize is permissionless and takes the starting price from whoever calls it. Anyone can initialize a freshly created pool at an absurd price. That is accepted by design, arbitrage corrects it. But any protocol reading slot0 on a brand new pool is reading a number a stranger chose. Lending protocols have been burned by exactly this.

Uniswap V3's oracle rests on one fact from school maths. The arithmetic mean of a logarithm is the logarithm of the geometric mean. Tick is log base 1.0001 of price. So averaging the tick gives you a geometric mean price, symmetric in both directions, from a single accumulator.

"Has your protocol been audited?" "Yes." Four seconds, and both people just treated a word as a binary. A better answer takes thirty seconds: what was reviewed, when, what changed since, what's monitored now, what the re-audit trigger is. Only a team with a posture can give it — which is exactly why investors should ask for it.

Season 2 of our audit grants closes tomorrow. Here is every reason people tell me they didn't apply, and why none of them hold. — "My code isn't ready." It isn't supposed to be. We score the scaffolding, not the flaws — your bugs are the reason the grant exists, not a mark against you. A messy codebase on solid foundations is the ideal applicant. Waiting until your code is clean means applying for an audit you no longer need. — "My repo is private." Mutual NDA, issued instantly from your dashboard, already signed on my side, executed online in about a minute. Plenty of Season 1's applications were private repos. It has never been treated as a red flag. — "I haven't done the scoring tasks." Then do one. Running Krait on your repo takes minutes and it's points on the board. You don't need all forty to be competitive — you need more than zero. — "I probably won't win." Eight protocols applied last season. Eight received a grant. There were no rejections. And where a full audit genuinely isn't right for your stage, I'll tell you that and point you somewhere honest instead of selling you one. The worst case here is that a senior auditor reads your code and tells you what he thinks. — "I don't have time." Thirty minutes if your scope is ready. Freeze a commit, know your line count — that's most of it. Drafts save automatically. — And if you already have a draft open: it needs submitting. A draft is not an application and I can't score it. That's how we lose good protocols every single season, and it's the one that genuinely frustrates me. — Closes October 4, 23:59 UTC. Winners October 11. grants.zealynx.io/grants/sea…

When I review a stablecoin, I do not start by asking whether the peg formula looks clever. I start by tracing who can create supply, what proves the backing, which price is trusted, and what happens when redemption demand spikes. The peg is the visible output. The real security model is the control chain underneath it. This is the checklist I would use to map that chain: zealynx.io/resources/checkli…

Most reentrancy guards are defence in depth. In Uniswap V3 the lock is load-bearing. The pool never calls transferFrom. It verifies payment by snapshotting its own balance, calling back into you, and requiring the balance grew. Without the lock, one token transfer could be counted toward two different debts.