What's New

Most courses teach a language by showing you code written for the course. This one does the opposite, and the difference is the whole point: you learn to read what is actually out there by reading what is actually out there. WETH9, the contract that turns ETH into a token. The ERC20 the whole ecosystem inherits from. The proxy shape that makes people think they cannot read Solidity, which turns out to be sixty nine lines. Uniswap V2's core, written in a version of the language that is not the one you have been reading. Safe's owner list, which is a linked list hiding in a mapping and says so nowhere except one comment.

Five acts. First Contact gets you inside a file. The Vocabulary gives you every word, met inside real code rather than in a syntax table. The Grammar is contracts built from other contracts: inheritance, libraries, the raw call underneath the syntax, proxies, and where a proxy keeps the address of the code that actually runs. Fluent Reading drops the scaffolding and hands you unfamiliar files cold. And the last act, Writing With a Machine, turns the whole method onto code a model wrote, because that is the real job now and you cannot supervise what you cannot read.

Every board is either real and pinned, or openly marked as not real. The last act needs machine output, so those boards carry a chip that says not a deployed contract, and a build gate refuses to ship an unlabelled one. Every other source in the course is re-fetched from GitHub and compared byte for byte on every check, so a contract cannot quietly drift from the thing it claims to be. Zero security content anywhere in it, by design. This is the language, not the audit.

Every Solidity course starts by making you write code, which front-loads a compiler, a test framework and a deployment story, none of which is the language. The skill most people actually need is the other one: open a contract you did not write and know what it does. Founders signing them, analysts pricing them, engineers arriving from another stack. The industry teaches writing and hopes reading arrives as a side effect. It usually does not.

So this course is a sequence of real contracts read line by line, the way Carlos teaches Rust on his channel. The code is the board. The lens walks from the licence comment to the closing brace, dimming what you have passed, writing notes in the margin, and stopping before each reveal to make you commit to an answer. Twenty four lines that hold real money, and by the end nothing in them is a mystery.

One checkpoint is live today, and it is the format prototype: a PiggyBank contract, five gates, about twenty five minutes, no account needed. The full reading list follows, ending where it should end, with you opening a verified contract you have never seen and reading it cold. Zero security content anywhere in it, by design. This is the language, not the audit.

A score tells you what you missed. It does not tell you how you were supposed to find it. So the first two arenas now ship a detection layer: every finding carries the concrete steps that surface it, grounded in the real source at real line numbers. Basin's highest-severity finding, for instance, reduces to a set difference between two grep results, with no protocol insight required at all.

Each finding also names the plausible approach that returns clean. That is the part nobody writes down: the reasonable-looking check you would have run, the one that comes back fine, and the reason 'I looked and it seemed fine' becomes false confidence instead of a finding. Alongside it, a Commonly Confused Patterns catalog built from what real submissions actually reported, so you can see which of your almost-findings were near misses and which were mirages.

Above the findings sits an audit-level debrief: the theme that ties the codebase together, the lenses that would have surfaced the bugs, and where to start reading. Every finding is also contrasted against the Uniswap V2 you built by hand, so a fork's bug lands as a delta from code you already know rather than as trivia. Live now on Basin and ElasticSwap, with the rest of the arenas following.

Most crypto losses don't start with a smart-contract bug. They start with a message, a signature, or a repo you were asked to run — the human layer no audit covers. Defense trains that layer directly. Instead of a lecture, each drill drops you into a faithful replica of the surface the attack really uses and lets you make the call, live: connect or refuse, sign or reject, run it or read it first.

Ten channels, twenty-one drills. Fake recruiters across LinkedIn and Telegram, approval and permit phishing in the wallet popup, seed-phrase phishing in your inbox, hijacked-account airdrops on X, the fake-support 'Safeguard' bot, address poisoning, malicious packages, deepfake video calls, and pig butchering over SMS. Every drill runs the same four beats — a briefing, the live drill, a debrief that marks every red flag on what you saw, and the concrete defense — and you earn Lynx for every clear.

The first drills are free, no account needed. Everything is simulated: nothing is real, nothing runs, nothing sends. Make the mistake here, so you never make it out there where it's irreversible.

The Uniswap V3 build module has a matching Shadow Arena path: seven time-boxed audits of real concentrated-liquidity protocols that went through public security contests. Every finding is quoted from an actual Code4rena, Sherlock, or Spearbit report, and every one maps back onto code you wrote by hand — the swap loop, tick accounting, fee growth, the oracle, the factory, callback-based payment.

The set is built for range. QuickSwap/Algebra and Ramses (4 days) are the clean entry points where a single change to canonical V3 broke fee accounting. Slipstream (7 days) is a two-layer audit: canonical V3 bugs you could catch in your own pool, plus gauge-staking deltas. Panoptic and Real Wagmi are the 'audit the layer above' integrations. And KyberSwap Elastic (10 days) is the expert capstone: a competitive audit ran on the exact code in July 2023, missed a rounding-direction bug in the swap loop, and that bug drained $48M in November. Find what the auditors didn't.

Free, timed, scored against the real findings. Build the protocol, then break its forks.

You asked for it more than any other module, and it is finally here. Building Uniswap V3 takes you from the V2 world you already know into the machine that redefined AMM design: concentrated liquidity. Not a tour. You write it. Every tick, every bitmap word, every step of the swap loop.

Part 1 builds the math: the tick coordinate system, sqrtPriceX96, SqrtPriceMath with its security-critical rounding directions, the Tick and Position libraries, and the fee-growth-outside trick that makes per-position fee accounting possible at all. Part 2 assembles the pool: mint, burn, collect, and the swap loop itself, the single most instructive function in DeFi. Part 3 finishes with the observation ring buffer oracle, flash loans, the factory, and a single-hop SwapRouter, including why unverified callbacks are the number one V3 integration bug.

18 sections, three parts, modernized to Solidity 0.8.x, with the same starter-code-plus-tests flow as every build module. If you finished Building Uniswap V2, this is your next step. And once you have written the swap loop yourself, the V3 fork ecosystem, the largest in DeFi, stops being intimidating and starts being readable.

You have heard of DeFi. Maybe you even use it. But between you and the people who live in it sits a wall of words nobody stops to explain: funding rates, impermanent loss, ve-tokenomics, real yield, FDV. Your First 90 Days in DeFi tears that wall down one checkpoint at a time, starting where DeFi actually starts: how any market works, from the NYSE to an AMM pool.

24 interactive checkpoints across four acts: The Market, The Protocols, The Deep Water, and Fluency. You will follow leverage to its liquidation, walk the x times y equals k curve, find out where every yield really comes from, and finish by reading a protocol you have never seen, cold, in twenty minutes. One question runs through the whole course: who is paying, and why? Answer it reflexively and you stop being a tourist.

About twenty minutes per checkpoint, Lynx and the 90 Days leaderboard included, and no code anywhere. The first three checkpoints need no account. If you are brand new, start with Your First 90 Days in Web3 first; this course picks up where it leaves off and goes deep.

Zealynx Insiders is the room we wish existed when we got into security. Not a course you finish, and not another chat channel, but a membership where devs, founders, auditors, and anyone between roles keep getting better alongside people on the same path. It is worth more the longer you stay.

Inside: Zealynx Live weekly sessions where the room works through real content together, a library of findings, prompts, and post-mortems, a member directory, ranks and a leaderboard, office hours with Carlos, and study groups you can run yourself. Founders also get direct advice, Krait runs on their contracts, and a founding discount on a full Zealynx audit. You also get a direct support line to the whole Zealynx stack: the Academy, Audit Grants, and Krait.

Founding pricing is $20 per month, locked for life, for anyone who joins before July 16. After that it moves to $50. Joining the waitlist is free, and there is no charge until we open. Reserve your seat and you are first in line.

New to Web3, or been around a while without ever building the foundation? Foundations is your on-ramp. Your First 90 Days in Web3 walks the whole space, what crypto and DeFi actually are, wallets, NFTs, scams, security, one connected idea at a time, until it stops being noise and becomes a map you can read.

24 interactive checkpoints across four acts, about twenty minutes each. You learn to judge things by what they do, not what they say, the same lens a professional auditor uses. Earn Lynx as you go and climb the new 90 Days leaderboard. The first three checkpoints need no account, and an audio companion is coming soon.

Finish a Build module, review a Shadow Arena audit, ship an AI Auditor, wrap an eMBA module, or unlock a new rank. When you share it to X for your +10 Lynx, the post now lands publicly on the Academy Feed. Click any entry to read the original tweet, see the card, or open the builder's profile.

Two-column layout on desktop with a live sidebar (top builders this week, trending protocols and audits), a sticky filter strip to slice the feed by kind, and verification gating so every entry on the page is a real tweet from a real builder. No engagement gaming, no follower-of-followers noise. Only shipped work.

Find it from the Header (Feed tab), or directly at /feed. At launch you will see a sample timeline showing what each card kind looks like; those disappear automatically once real posts start landing.

The Build track gains its fourth protocol: Liquity V1, the cleanest CDP/stablecoin design in DeFi. Open a Trove, borrow LUSD against ETH, absorb liquidations into the Stability Pool, enforce the peg through redemptions — every function, every invariant, modernized to Solidity 0.8.x. 15 sections across 3 parts.

Paired with it: four new Shadow Arena audits on real Liquity forks — Gravita (multi-collateral), Lybra V2 (liquid-staked collateral), Tapioca (cross-chain, a 4-week boss fight), and Raft (a true production fork, including the precision bug behind a $6.7M exploit). Build the protocol, then break its forks.

Hit a milestone — a finished Build module, a reviewed Shadow Arena audit, a completed eMBA module, or the AI Auditor Builder — and a Share-to-X card now appears on the completion screen and on your dashboard. Post it, and +10 Lynx land in your balance.

No farming: the bonus is gated on real completion and capped at one claim per milestone per account, enforced server-side.