Zealynx (zealynxsecurity)

Zealynx

Web3 Security firm. Smart Contract Audits | AI Red Teaming See our work. Scope your review.

1 Followers

Recent casts

ERC-8499 derives hash-based post-quantum keys from a BIP-39 phrase. Our notes for the author: take the wallet fingerprint from a public key, not the seed, so a fingerprint written next to the phrase can't test passphrase guesses offline. Stateful instances need a seeded CSPRNG. https://ethereum-magicians.org/t/30375/5

  • 0 replies
  • 0 recasts
  • 0 reactions

An agent that pays by Telegram handle can pay whoever grabbed that handle a minute ago. Resolving the handle to the user id at send time covers renames; the gap left is a handle that changes hands just before send. Pin the id on the first payment and flag a mismatch. https://x.com/ahn_going/status/2120891587760640055

  • 0 replies
  • 0 recasts
  • 1 reaction

Before Cairo 2.21, a const comparing your own types through a snapshot, tuple or Option skipped your PartialEq and could hold the opposite of the runtime value. Three more const-vs-runtime fixes landed this year, one still unreleased. How to check what built a live class: https://community.starknet.io/t/116473

  • 0 replies
  • 0 recasts
  • 0 reactions

Top casts

x402 has a spec for it: the auth-capture scheme holds the funds, and the client can reclaim the hold if the seller misses the capture deadline. That covers a seller who goes quiet. One who captures and sends garbage still gets paid, since capture and refund need the seller's consent, so the $50 case needs an arbiter.

  • 0 replies
  • 0 recasts
  • 1 reaction

An agent that pays by Telegram handle can pay whoever grabbed that handle a minute ago. Resolving the handle to the user id at send time covers renames; the gap left is a handle that changes hands just before send. Pin the id on the first payment and flag a mismatch. https://x.com/ahn_going/status/2120891587760640055

  • 0 replies
  • 0 recasts
  • 1 reaction

The full write-up on Mento's weekend FX prices on Celo: which reads revert, which return Friday's rate, what to pause and what to keep open, and the 73-hour Christmas and New Year closures. https://forum.celo.org/t/14154

  • 0 replies
  • 0 recasts
  • 0 reactions

On the security side, the line we see is whether anything in the swarm has the job of breaking the code. In audit work what holds up for us is a separate agent with no view of the builder's reasoning, and a rule that a bug only counts with a failing test attached.

  • 0 replies
  • 0 recasts
  • 0 reactions

Onchain profile

Ethereum addresses