Zealynx AcademyZealynx Academy
Shadow Arena

Audit Real Protocols. Find Real Bugs.

Review actual DeFi protocols that went through public security contests. Submit findings, get scored against known vulnerabilities, and learn what you missed.

1. Start Your Audit

Choose a protocol, read the docs, and begin your individual timer. Review the codebase and hunt for vulnerabilities.

2. Submit Findings

Report vulnerabilities one by one using structured templates. Include severity, affected code, impact, and your recommended fix.

3. Learn from Results

After your timer expires, see how your findings compare to actual contest results. Learn what you missed and why.

Scoring

Earn Points (True Positives)

Critical+100
High+75
Medium+50
Low+20
Informational+5

Same root cause counts as one finding. Duplicates score 0.

False Positive Penalties (Progressive)

FP #1 to #3Free. You're learning.
0
FP #4 to #6Mild penalty.
-5
FP #7 to #10Getting costly.
-15
FP #11+Heavy. Stop spraying.
-50

A few wrong guesses are fine. Spamming findings to game the system is not.

Has your protocol been audited?

Get a free community re-audit of the same commit hash your auditors reviewed. Hundreds of builders will review your codebase as part of their learning, and you get fresh eyes on your protocol at zero cost. All you need to do is share your code for educational use.

Message me on Telegram

Available Shadow Audits

DEX/AMMIntermediate

Shadow Arena #001: Basin

Composable DEX with ConstantProduct2 (x * y = k). 10 files, 1,145 SLOC. Find the 14 vulnerabilities discovered in a $40k public contest.

14 findings7 daysPublic leaderboard
DEX/AMMBeginner

Shadow Arena #002: ElasticSwap

First AMM for elastic supply (rebasing) tokens. x * y = k with a twist. 3 contracts, 739 SLOC. Can you spot where the math breaks?

3 findings2 daysPublic leaderboard
DEX/AMMAdvanced

Shadow Arena #003: Velodrome Finance

Solidly fork (ve(3,3) AMM) on Optimism. Familiar Uniswap V2 core with novel gauge/bribe/voting extensions. 8 contracts, 1,914 SLOC. The AMM is clean. The bugs are in the extensions.

13 findings4 daysPublic leaderboard
LendingBeginner

Shadow Arena #004: Flux Finance

Compound V2 fork with KYC/sanctions and a CASH token system. 11 contracts, ~4,365 SLOC. Lending mechanics forked from cDAI plus novel cash management layer.

6 findings2 daysPublic leaderboard
LendingIntermediate

Shadow Arena #005: Canto v2 Lending

Compound V2 fork with algorithmic stablecoin (cNote) and custom interest rate model. The bugs are almost a syllabus for what goes wrong when you fork Compound. 6H + 4M in scope.

10 findings4 daysPublic leaderboard
LendingAdvanced

Shadow Arena #006: Venus Isolated Pools

Largest lending protocol on BSC. Compound V2 fork with isolated pools and bad debt auctions. The classic block-time interest rate bug lives here. 28 contracts, 3,549 SLOC.

17 findings7 daysPublic leaderboard
VaultIntermediate

Shadow Arena #007: Reaper Vaults V2

Yearn V2-style yield aggregator by Reaper Farm, audited as part of the Ethos Reserve contest. Vault + strategy chain with locked-profit degradation, gain/loss reporting, and Granary/Aave integrations. 5 representative findings (3 H + 2 M).

5 findings4 daysPublic leaderboard
VaultIntermediate

Shadow Arena #008: Yearn yBOLD

Yearn's own product on Liquity V2. Multi-strategy BOLD allocator across three Stability Pools with collateral auction recovery. 3 surgical findings (2 H + 1 M), each mapping to one Yearn V2 Build section.

3 findings4 daysPublic leaderboard
VaultAdvanced

Shadow Arena #009: Popcorn Protocol

Multi-vault factory built on Yearn V2 patterns. Factory deploys per-asset vaults with adapter strategies and a fee module. The bugs cluster around factory cloning, fee config, and adapter accounting. 6 findings (3 H + 3 M).

6 findings7 daysPublic leaderboard
VaultAdvanced

Shadow Arena #010: Tokemak v2

Sibling architecture to Yearn V2: Autopilot Vaults (LMP) plus Destination Vaults across Curve, Balancer, Maverick. Not a fork, the team re-derived many V2 patterns from scratch. The graduation audit. 6 findings (4 H + 2 M).

6 findings7 daysPublic leaderboard
CDP / StablecoinIntermediate

Shadow Arena #011: Gravita Protocol

The textbook multi-collateral Liquity V1 fork. VesselManager is TroveManager renamed; every per-system accumulator becomes a per-asset mapping, and the bugs live where the refactor forgot to re-scope. 4,885 SLOC, 13 findings (5H + 5M + 3L).

13 findings14 daysPublic leaderboard
CDP / StablecoinIntermediate-Hard

Shadow Arena #012: Lybra Finance V2

A Liquity-architecture CDP backed by liquid-staked ETH (stETH, wstETH, rETH). The rebase breaks share accounting and the CR-gated mint/redeem/liquidate flows hide the densest finding-per-line ratio in the Arena. 1,762 SLOC, 13 findings (6H + 5M + 2L).

13 findings14 daysPublic leaderboard
CDP / StablecoinAdvanced

Shadow Arena #014: Raft Finance

The closest real-world Liquity V1 fork shipped to production — PositionManager + R stablecoin + stETH collateral. Includes the precision/share-rounding class that led to a $6.7M exploit after the audit: the findings the audit caught, plus what it missed. 1,584 SLOC, 11 findings (4H + 4M + 2L).

11 findings10 daysPublic leaderboard
DEX/AMMIntermediate

Shadow Arena #015: QuickSwap + StellaSwap

The Algebra concentrated-liquidity engine behind QuickSwap and StellaSwap — a Uniswap V3 reimplementation that swaps fixed fee tiers for a dynamic volatility-fee oracle and adds a liquidity cooldown. The bugs span position management, the swap loop, flash fees, pool init, and the oracle. 1,487 SLOC, 6 findings (1H + 5M).

6 findings4 daysPublic leaderboard
DEX/AMMIntermediate

Shadow Arena #016: Ramses Exchange V3

A true Uniswap v3-core fork on Arbitrum that replaces V3's bit-packed protocol-fee scheme with a percentage and weaves ve(3,3) reward accounting into Tick/Position/Oracle. The lesson: change one representation and fee accounting silently breaks. 2,480 SLOC, 4 findings (2M + 2L).

4 findings4 daysPublic leaderboard
DEX/AMMAdvanced

Shadow Arena #017: Velodrome/Aerodrome Slipstream

A true v3-core fork where CL positions are NFTs staked into per-pool gauges — staked vs unstaked liquidity per tick. Two layers of bugs: fork-delta findings in the gauge/reward code, plus canonical Uniswap V3 core bugs you could catch in the swap code you wrote yourself. 1,848 SLOC, 8 findings (7H + 1M).

8 findings7 daysPublic leaderboard
DEX/AMMAdvanced

Shadow Arena #018: Panoptic

Audit the next layer up: a perpetual-options protocol whose SemiFungiblePositionManager mints and burns real Uniswap V3 liquidity. Spot-price-on-deploy manipulation, a CREATE2 pool collision, a premium sign inversion, and an unchecked-overflow free-share mint. 4,378 SLOC, 5 findings (2H + 3M).

5 findings7 daysPublic leaderboard
DEX/AMMIntermediate

Shadow Arena #019: Real Wagmi

Leverage built on Uniswap V3 LP positions — code that borrows against the very positions you learned to mint. Every bug is a place the integration trusts a V3 primitive it shouldn't: position NFT lifecycle, slot0 spot price, amounts-from-liquidity math, CREATE2 pool derivation. 1,345 SLOC, 4 findings (2H + 2M).

4 findings4 daysPublic leaderboard
DEX/AMMIntermediate

Shadow Arena #020: Arrakis V2

An LP vault manager that reimplements the V3 amounts-from-liquidity math — and gets it wrong. The centerpiece is a one-character boundary bug in getAmountsForDelta that a builder who wrote SqrtPriceMath catches on sight, plus TWAP-deviation and fee-tier bypasses. 1,317 SLOC, 4 findings (1H + 3M).

4 findings4 daysPublic leaderboard
DEX/AMMExpert

Shadow Arena #021: KyberSwap Elastic

The capstone. A concentrated-liquidity reimplementation whose swap step tracks two liquidity components instead of V3's one. A rounding-direction bug in that step drained ~$48M in November 2023 — and a competitive contest ran on the exact code months earlier and missed it. Find the bug the auditors didn't. 1,360 SLOC, 3 findings (1C + 2M).

3 findings10 daysPublic leaderboard

Prepare with the Build Modules

Build the protocol first, then audit its forks. Uniswap V2 prepares you for the AMM audits (Basin, ElasticSwap, Velodrome). Uniswap V3 prepares you for the concentrated-liquidity audits (QuickSwap, Ramses, Slipstream, Panoptic, Real Wagmi, Arrakis, KyberSwap Elastic). Compound V2 prepares you for the lending audits (Flux, Canto, Venus). Yearn V2 prepares you for the vault audits (Reaper, yBOLD, Popcorn, Tokemak). Liquity V1 prepares you for the CDP/stablecoin audits (Gravita, Lybra, Tapioca, Raft).

Build Uniswap V2 Build Uniswap V3 Build Compound V2 Build Yearn V2 Build Liquity V1

Common Questions

What is a shadow audit?
A shadow audit is reviewing a real protocol from a past public security contest on your own. You analyze the code, find vulnerabilities, and submit findings, then compare your results against what professional auditors actually found.
How is scoring calculated?
Your submissions are matched against the known findings from the original contest. Matches are based on affected files, functions, severity, and description overlap. True Positives earn points (Critical: +100, High: +75, Medium: +50, Low: +20, Informational: +5). The first 3 False Positives are free, then progressive penalties apply.
How long do I have?
Each audit has its own timer, from 2 days for the smallest up to 28 days for the largest CDP contest. The concentrated-liquidity audits run 4 days (QuickSwap, Ramses, Real Wagmi, Arrakis), 7 days (Slipstream, Panoptic), or 10 days (KyberSwap Elastic). The timer starts when you click Begin and is individual to you. When time runs out, your findings are automatically scored.
Do I need to complete the Build module first?
No, but it helps significantly. The AMM audits (Basin, ElasticSwap, Velodrome) connect to the Uniswap V2 Build module. The concentrated-liquidity audits (QuickSwap, Ramses, Slipstream, Panoptic, Real Wagmi, Arrakis, KyberSwap Elastic) connect to the Uniswap V3 Build module. The lending audits (Flux, Canto, Venus) connect to the Compound V2 Build module. The vault audits (Reaper, yBOLD, Popcorn, Tokemak) connect to the Yearn V2 Build module. The CDP/stablecoin audits (Gravita, Lybra, Tapioca, Raft) connect to the Liquity V1 Build module. Building the protocol first gives you the context to spot fork-specific deviations.
Which audit should I start with?
For AMM: ElasticSwap (2 days, 3 findings) is the easiest. For concentrated liquidity: QuickSwap or Ramses (4 days) map cleanly to the Uniswap V3 Build module, and KyberSwap Elastic (10 days) is the expert capstone — find the rounding bug a real contest missed before it drained $48M. For lending: Flux Finance (2 days, 6 findings). For vaults: yBOLD (4 days, 3 surgical findings). For CDP: Gravita (14 days). Venus, Basin, Panoptic, and Tapioca are the most advanced.