A week inside Zealynx Insiders. Membership value should be visible in the work, not hidden behind landing-page promises. Here is what happened from 19 to 25 September.

A fee formula in Uniswap V3 that forks keep getting wrong. You hold the NET input and need the fee that corresponds to it, so you gross it back up: mulDivRoundingUp(amountIn, feePips, 1e6 - feePips) Not 1e6. Minus feePips. Get that denominator wrong and you charge a fee on a fee.

I run a grants programme that gives away smart contract audits. Last season, eight protocols applied. Eight got funded. There were no rejections — not one. Here is why that happened, and why Season 2 is open until October 4. — Why the programme exists Almost every early-stage founder I talk to makes the same trade. A serious audit costs more than the runway allows. So they ship unaudited and hope, or they don't ship at all. I've watched good protocols take that bet. I've watched some of them lose it. That trade is the thing I'm trying to break. Not with a discount code — with real money against real engagements. — What actually happened in Season 1 Eight protocols applied, across six chains and four continents, with zero paid distribution. Not one was VC-funded. That's the number I'm proudest of. We published the Builder tier at 25%. Then I read the applications: frozen commit hashes, honest line counts, real invariant suites. One team's mutation testing proved their own tests could fail. That isn't a pitch deck, that's engineering. So we upgraded every Builder Grant to 50%. One time, in return for the trust those teams placed in a first-season programme. Every applicant got an individual decision with the reasons. No form letters. — The part founders get wrong We score the scaffolding, not the flaws. Your bugs are not held against you. Your bugs are the reason the grant exists. A rich bug surface on solid foundations is the ideal applicant, not a disqualification. If you've been putting this off because you think your code isn't ready — that's exactly backwards. Wait until it's clean and you'll be applying for an audit you no longer need. — Season 2 One protocol gets its audit 100% covered. Two get 50%. Builder grants cover 25% for the rest of the round. Over $100,000, subsidised against our standard rate of $6,000 per auditor per week. Same founder-led, senior-only audit our paying clients get. Every report publishes in full when the engagement completes. Applications close October 4. Winners announced October 11. grants.zealynx.io/grants/sea…

I keep correcting agent mistakes with more instructions. The uncomfortable part is that the next version can still make exactly the same mistake. Most of my Hermes workflows improve through prompts, files and recorded corrections. That works, but the correction remains prose. Nothing automatically proves that the failure has actually been removed. I have now found a Hermes plugin called Afterforge that approaches this differently. It can inspect a failed tool run, preserve the correction as a reviewable hypothesis and turn an approved case into an executable pytest regression. The important part is that the agent cannot approve its own test. A human has to inspect and approve the exact regression recipe first. I do not have the right failure case for it yet, and I would only test it with non-sensitive workflow history because it stores a separate local, unencrypted copy of bounded conversation data. But the idea is interesting. Instead of telling an agent “do not make this mistake again,” I could eventually require the next version to prove it no longer does. That is a much stronger form of memory than another paragraph in a prompt.

"$50K for an audit" is wrong in three specific ways: It assumes one engagement, when the code will change. It assumes a fixed price, when scope and your own prep move it 2-3x. It assumes security is bought once, not run. Bring your own number to lesson 2. Most people move it.

Three years ago my newsletter, DeFi Protocol by code, went quiet. Today it's back, with gifts for the 282 people who stayed: - the full archive, now free - free security courses for founders and devs - a free first pass on your code with Krait - a fully covered audit, up to $24K, until Oct 4

When I verify audit fixes, I do not ask only whether the original exploit still works. I review the patch as new code: trace the root cause, test alternate paths, then look for fresh bugs introduced under remediation pressure.

Integer division truncates. In a DEX, every truncation is a decision about who eats the lost fraction. Uniswap V3 answers it the same way in every branch of every function. Input rounds up. Output rounds down. Fee rounds up. Every wei of rounding error lands on the pool's side of the ledger.

The highest-return security spend for most new protocols isn't the audit. It's the threat model written before it and the monitoring running after, because those two cover the window an audit structurally can't. I sell audits. Judge the argument on the numbers rather than on who's making it — they're in the lesson.

When I audit staking systems, I treat emergency mode as a separate product state. I ask what a user can still do after deposits stop: claim, unstake, or exit. A pause is not safe if the protocol survives by trapping the people it is meant to protect.

If you hold a Uniswap V3 position and call collect, you may withdraw less than you have earned. collect does not settle fees. It reads tokensOwed as it finds it, and tokensOwed only changes when something calls position.update. The fix is burn(0) first. It is a documented idiom, not a trick.

Weekly membership value should be visible in the work, not hidden in landing-page promises. This week inside Zealynx Insiders: WHAT MEMBERS WORKED ON One member completed a Teller audit and turned two collateral-flow findings into a broader review method.

A bridge lost $624M and nobody noticed for six days. Not a clever exploit — no alert existed for a large withdrawal, so nothing fired. A user found it when their own transaction failed. Monitoring costs $2-20K a month. It's the line most budgets don't have at all, and it's the difference between four hours and six days.

When I audit ERC-4626 vaults, I do not stop at the normal deposit path. I test the empty-vault state, direct donations, and rounding together. Dead shares help, but the real question is whether any realistic sequence can make a user deposit mint zero shares.

Without prior experience auditing manually, I don’t think AI auditing can be done properly. In my final Quantus sweep, five of six parallel agents returned reasoned negatives. The sixth produced passing PoCs, but they only rediscovered an existing finding. None of those outputs could be accepted at face value. I strongly question every finding the agents return. But I also question them when they return nothing. A reasoned negative can help me decide where not to spend more resources. It does not mean an area has been completely checked, and it definitely does not mean the audit is done. This is what makes leading AI audit agents difficult. You need to stop them from inventing vulnerabilities to satisfy the prompt, while also stopping them from declaring completion because they exhausted one path. I don’t see this as replacing one auditor with six agents. It is about navigating and leading the resources LLMs give you: challenging findings, questioning negative results, noticing missing coverage and deciding where each agent should search next. The agents can explore and test much more than I can alone. But my previous manual auditing experience is what lets me judge whether their work actually means anything.

burn is the one place in Uniswap V3 where you can see both halves of the rounding policy side by side. Mint rounded up against you. Burn rounds down against you. Every rounding boundary in the protocol leans the same direction. The dust stays in the pool.

What a security budget actually contains, at $50M TVL: Audit, $40-100K. Monitoring, $2-20K/mo. Bounty max, 10% of what you hold. Incident retainer, ~$15K. Verification in CI, mostly engineering time. Most founders write one line for the first item and nothing for the rest. That's the real mistake, not the size of the number.

My view: if one role can move every holder’s assets, it is a custody system—not a normal admin permission. I would require multiple signers, an execution delay, and a legal authorization trail before treating forced transfer as production-ready.

Call burn on your entire Uniswap V3 position and your wallet receives exactly nothing. Not a revert. It works perfectly, and no tokens move. Your position became a debt the pool owes you. Getting it out is a second function, and that split buys three things.

The best thing I did with Hermes was stop treating it like one assistant. It works much better for me as a group of small agents with one responsibility each. Cron starts the work. Files preserve the state. Agents run independent parts in parallel. Telegram becomes the approval gate before anything public or difficult to reverse. This is how I have one agent maintaining three websites every day, while other workflows handle research, content, audits and operations without all of them sharing the same context. It works, but most of the orchestration is hidden across prompts, cron jobs, files and handoffs. When something fails halfway through, understanding what completed and what needs to run again is still more manual than I would like. Hermes now has workflow graphs with parallel nodes, approval gates, budgets, explicit failure states and resume. If one node changes or crashes, it can continue without repeating everything that already worked. I want to move one real workflow into it and compare both approaches. What I want to understand is not whether the graph looks better. It is whether the workflow becomes easier to inspect, recover and improve without adding another layer I need to maintain.