A week inside Zealynx Insiders. Membership value should be visible in the work, not hidden behind landing-page promises. Here is what happened from 19 to 25 September.

A fee formula in Uniswap V3 that forks keep getting wrong. You hold the NET input and need the fee that corresponds to it, so you gross it back up: mulDivRoundingUp(amountIn, feePips, 1e6 - feePips) Not 1e6. Minus feePips. Get that denominator wrong and you charge a fee on a fee.

I run a grants programme that gives away smart contract audits. Last season, eight protocols applied. Eight got funded. There were no rejections — not one. Here is why that happened, and why Season 2 is open until October 4. — Why the programme exists Almost every early-stage founder I talk to makes the same trade. A serious audit costs more than the runway allows. So they ship unaudited and hope, or they don't ship at all. I've watched good protocols take that bet. I've watched some of them lose it. That trade is the thing I'm trying to break. Not with a discount code — with real money against real engagements. — What actually happened in Season 1 Eight protocols applied, across six chains and four continents, with zero paid distribution. Not one was VC-funded. That's the number I'm proudest of. We published the Builder tier at 25%. Then I read the applications: frozen commit hashes, honest line counts, real invariant suites. One team's mutation testing proved their own tests could fail. That isn't a pitch deck, that's engineering. So we upgraded every Builder Grant to 50%. One time, in return for the trust those teams placed in a first-season programme. Every applicant got an individual decision with the reasons. No form letters. — The part founders get wrong We score the scaffolding, not the flaws. Your bugs are not held against you. Your bugs are the reason the grant exists. A rich bug surface on solid foundations is the ideal applicant, not a disqualification. If you've been putting this off because you think your code isn't ready — that's exactly backwards. Wait until it's clean and you'll be applying for an audit you no longer need. — Season 2 One protocol gets its audit 100% covered. Two get 50%. Builder grants cover 25% for the rest of the round. Over $100,000, subsidised against our standard rate of $6,000 per auditor per week. Same founder-led, senior-only audit our paying clients get. Every report publishes in full when the engagement completes. Applications close October 4. Winners announced October 11. grants.zealynx.io/grants/sea…

I keep correcting agent mistakes with more instructions. The uncomfortable part is that the next version can still make exactly the same mistake. Most of my Hermes workflows improve through prompts, files and recorded corrections. That works, but the correction remains prose. Nothing automatically proves that the failure has actually been removed. I have now found a Hermes plugin called Afterforge that approaches this differently. It can inspect a failed tool run, preserve the correction as a reviewable hypothesis and turn an approved case into an executable pytest regression. The important part is that the agent cannot approve its own test. A human has to inspect and approve the exact regression recipe first. I do not have the right failure case for it yet, and I would only test it with non-sensitive workflow history because it stores a separate local, unencrypted copy of bounded conversation data. But the idea is interesting. Instead of telling an agent “do not make this mistake again,” I could eventually require the next version to prove it no longer does. That is a much stronger form of memory than another paragraph in a prompt.

"$50K for an audit" is wrong in three specific ways: It assumes one engagement, when the code will change. It assumes a fixed price, when scope and your own prep move it 2-3x. It assumes security is bought once, not run. Bring your own number to lesson 2. Most people move it.

Three years ago my newsletter, DeFi Protocol by code, went quiet. Today it's back, with gifts for the 282 people who stayed: - the full archive, now free - free security courses for founders and devs - a free first pass on your code with Krait - a fully covered audit, up to $24K, until Oct 4

When I verify audit fixes, I do not ask only whether the original exploit still works. I review the patch as new code: trace the root cause, test alternate paths, then look for fresh bugs introduced under remediation pressure.

Integer division truncates. In a DEX, every truncation is a decision about who eats the lost fraction. Uniswap V3 answers it the same way in every branch of every function. Input rounds up. Output rounds down. Fee rounds up. Every wei of rounding error lands on the pool's side of the ledger.

The highest-return security spend for most new protocols isn't the audit. It's the threat model written before it and the monitoring running after, because those two cover the window an audit structurally can't. I sell audits. Judge the argument on the numbers rather than on who's making it — they're in the lesson.

When I audit staking systems, I treat emergency mode as a separate product state. I ask what a user can still do after deposits stop: claim, unstake, or exit. A pause is not safe if the protocol survives by trapping the people it is meant to protect.

If you hold a Uniswap V3 position and call collect, you may withdraw less than you have earned. collect does not settle fees. It reads tokensOwed as it finds it, and tokensOwed only changes when something calls position.update. The fix is burn(0) first. It is a documented idiom, not a trick.

Weekly membership value should be visible in the work, not hidden in landing-page promises. This week inside Zealynx Insiders: WHAT MEMBERS WORKED ON One member completed a Teller audit and turned two collateral-flow findings into a broader review method.

A bridge lost $624M and nobody noticed for six days. Not a clever exploit — no alert existed for a large withdrawal, so nothing fired. A user found it when their own transaction failed. Monitoring costs $2-20K a month. It's the line most budgets don't have at all, and it's the difference between four hours and six days.

When I audit ERC-4626 vaults, I do not stop at the normal deposit path. I test the empty-vault state, direct donations, and rounding together. Dead shares help, but the real question is whether any realistic sequence can make a user deposit mint zero shares.