Bloqarl | Zealynx
@TheBlockChainer
Founder of @ZealynxSecurity. 10 years QA → 4+ years Smart Contract Security.
Building an audit firm in public. Building for Web3 builders
1.1K Following 5.4K Followers
This is what a Zealynx Audit Grant actually looks like.
[📎 the $16,000 → −$16,000 → $0 screenshot]
A full two-week security audit. Standard price $16,000. The founder pays $0.
Not a discount code. Not a trial. A funded audit, start to finish.
Season 1 funded audits for 8 protocols across 6 chains, zero of them VC-backed. The first kicks off next week, and every report gets published.
Season 2 opens September 20. Applications run two weeks.
If a serious audit is the blocker between you and launch, register now, and you'll be first in when applications open.
Link below 👇
Show more
I built the Academy to make security education practical and free.
But while operating it, I kept seeing the limit of lessons: the moment someone applies them to a real protocol, the questions become specific to their code, trade-offs, and timing.
That is why I opened Insiders. It is the room around the curriculum—somewhere builders can bring the work they are doing now and get help from people doing the same work.
Show more
A course can teach a fixed lesson. It cannot review the code you changed this week.
Zealynx Insiders is now open with 30+ members: a working room for Web3 builders, founders, and security practitioners.
Weekly live sessions, Shadow Audits, 1:1 advisory, participating in public contests in teams of 3-4, and a network that stays with the work.
See the room:
Show more
I built this MCP checklist around a mistake I keep seeing in agent systems: reviewing tools one by one.
That misses what the agent can do after capabilities are combined.
My first pass is simple: draw every path from untrusted input to a sensitive source, then to an execution or outbound sink. Filesystem + network is the obvious example, but Git + shell or browser + credentials can be just as important.
The 24-check review surface is public here:
Show more
The dangerous capability in an MCP setup may not belong to any single tool.
A filesystem server can read data.
A network server can send data.
Together, they can create an exfiltration path even if each one looks acceptable in isolation.
That is why MCP reviews need a capability map across servers, not just a checklist per tool.
Zealynx's public MCP security checklist covers that combined surface alongside command execution, context poisoning, credentials, supply chain, SSRF, and audit logging.
Use all 24 checks free:
Show more
I built this MCP checklist around a mistake I keep seeing in agent systems: reviewing tools one by one.
That misses what the agent can do after capabilities are combined.
My first pass is simple: draw every path from untrusted input to a sensitive source, then to an execution or outbound sink. Filesystem + network is the obvious example, but Git + shell or browser + credentials can be just as important.
The 24-check review surface is public here:
Show more
The dangerous capability in an MCP setup may not belong to any single tool.
A filesystem server can read data.
A network server can send data.
Together, they can create an exfiltration path even if each one looks acceptable in isolation.
That is why MCP reviews need a capability map across servers, not just a checklist per tool.
Zealynx's public MCP security checklist covers that combined surface alongside command execution, context poisoning, credentials, supply chain, SSRF, and audit logging.
Use all 24 checks free:
Show more
I worked across all three Fair Casino reviews, and the pattern was clear: the dangerous assumption often lived between components, not within a single file.
A vault can enforce its rules while the backend credits the wrong user. A swap can settle correctly while the UI trusts a spoofable event.
That is why I do not treat “smart contracts audited” as “the product is secured.” I want the contract, backend, and client trust boundaries reviewed together.
Show more
A smart contract audit does not secure the API, game logic, or frontend events around it.
For Fair Casino, Zealynx reviewed three connected surfaces: the Solana vault program, the TypeScript core, and a follow-on SOL→FAIR swap flow.
The public reports show issues across every layer—from vault initialization to deposit attribution, seed timing, and WebSocket confirmations. Every reported issue in these three reviews was fixed and verified.
Security boundaries do not stop at the contract address.
Reports:
Show more
Meanwhile... in our last private audit at @ZealynxSecurity
30 findings: 1 Critical, 11 High, 9 Medium, 7
Low, and 2 Informational.
No time to rest, the next private audit has already started. Codebase similar size... will we repeat this?
Show more
I treat every external callback as a transaction that may never arrive successfully.
My review question is not only “what happens when the callback succeeds?” It is:
• What state was committed before it?
• What can make it revert?
• Who can recover, after what delay?
• Can recovery race with a late callback?
Async security lives in the transitions between transactions, not only inside each function.
Show more
Do people fight this or actually just accept the win?
A member said the honest thing: he jumped into competitions too soon, and now everyone runs the same AI and finds the same bugs.
The way out is not another lonely contest. Pairing up with other auditors early was one of the best things I ever did. You share approaches, and you learn from each other.
Show more
When I review a token integration, I separate three questions:
1. Did the external call revert?
2. Did the token report success correctly?
3. Did the expected amount actually arrive?
A wrapper helps with inconsistent ERC20 return behavior. It does not replace balance-delta checks when fees, rebasing or other token mechanics can change the amount received.
Show more
The bridge-audit question I care about is not only “does the transfer work?”
It is: can any alternate path mint, wrap or release more value than entered the system?
That means tracing native value, token value and permit value separately—especially through batches, remainders and upgrade paths. One reused or unchecked value source can break the bridge's accounting model.
Show more
A security-grant partnership should improve access, not buy selection.
Zealynx Audit Grants is now open to chains, accelerators, incubators, and hackathons that want to support their builders.
Partner affiliation can add verified context during review, but partners get no paid priority, no selection control, and no exclusivity. Zealynx keeps the final decision.
For ecosystem operators:
Show more
I designed the Zealynx Audit Grants partner route around one boundary: a partner can help us discover and verify a builder, but cannot buy that builder a grant.
That is why affiliation needs evidence and why final selection stays with Zealynx.
If you run a chain, accelerator, incubator, or hackathon, the model is here:
Show more
A security-grant partnership should improve access, not buy selection.
Zealynx Audit Grants is now open to chains, accelerators, incubators, and hackathons that want to support their builders.
Partner affiliation can add verified context during review, but partners get no paid priority, no selection control, and no exclusivity. Zealynx keeps the final decision.
For ecosystem operators:
Show more
The Uniswap V3 tick bitmap wraps its whole body in unchecked, with a comment saying overflow is "prevented externally by limiting both tickSpacing and tick".
That is true. But notice where the guarantees live: one layer up, in checkTicks and in the pool.
When you audit a fork, that comment is a claim you verify, not accept.
Show more
When I feel stuck on what to do next in my business, I open Claude or ChatGPT and just brainstorm.
Not for the AI to give me an answer. For me to find the right question.
The act of articulating what I'm stuck on, with enough context that the AI can respond usefully, forces me to clarify my own thinking. Half the time I find my answer in the prompt itself before I hit send.
This is the most underrated use of LLMs right now. Not "generate content." Not "replace work." Use them as the smartest possible journal partner who never gets bored of your problems.
If you have access to one of these tools and you're not using them this way, you're leaving real leverage on the table.
Show more
Solidity integer division truncates toward zero. The Uniswap V3 tick bitmap
needs floor division.
For positive ticks, those are the same. For negative ticks, they are not.
Get it wrong and a swap moving down through negative territory hunts for the next tick on the wrong side of the price. It is a recurring bug class in forks that "simplify" the library.
Show more
One of the best emails to read in the bathroom 🚽
It went out smoothly as a Critical, and after a false insight alarm, there it comes. Critical.
Krait's important design choice is not checklist size. It is forcing each applicable check back to the code.
PASS, FAIL or NEEDS REVIEW should come with file references—not team confidence.
That makes the checklist useful before an audit, without pretending it replaces one.
Show more
I built false-positive penalties into Shadow Arena because “report everything and let someone else triage it” is not an audit strategy.
When I audit, every candidate finding has to survive a strong set of checks and rules I’ve built.
A few wrong hypotheses are part of learning, so the Arena gives the first three false positives for free. But repeated spraying gets progressively expensive.
My view after building and using AI-assisted review systems: detection creates leads. Verification creates findings.
Show more
Finding more possible bugs is not the same as producing a better audit.
A useful reviewer must do two things:
→ detect real attack paths
→ reject weak hypotheses before they become findings
That is why Zealynx Academy's Shadow Arena scores both sides. You audit real protocols from past public contests on an individual timer, submit structured findings, and compare them with known results. True positives earn points; repeated false positives progressively cost points.
The goal is not to reward silence. It is to make evidence-backed judgment part of the practice.
Enter the Shadow Arena free:
Show more
Check this out. Build your own AI Security Agent Claude Skill.
Personalize it following the example from some of the best existing AI auditors.
And test it in the AI Arena I built.
An AI security auditor should not begin as one oversized prompt.
It needs explicit choices:
architecture → detection → reconnaissance → exploit context → verification → tools → output
Zealynx Academy's AI Auditor Builder turns those choices into a 12-step build path.
You finish by testing the skill against 5 planted Solidity vulnerabilities, publishing it, and benchmarking its unmodified output against real contest findings in the AI Auditor Arena.
The useful lesson: a security tool is not proven when it produces findings. It is proven when its findings survive verification and measurement.
Build yours free:
Show more
