Zenith

As 2025 comes to a close, here's a look back at what our team accomplished this year at Zenith. 1.) Nearly half of our 243 audits found High's and Crit's. In total, we found 292 High and 96 Critical-severity vulnerabilities. 2.) Starting audits under 24 hours' notice. Clients raved about this. Thank you to every Zenith auditor who made this possible. Your dedication, expertise, and clear communication were the key. 3.) We worked with leading protocols including Bridge, Zama, and Jupiter. We spanned 21 ecosystems, including Ethereum, Monad, Base, Solana, Move, and Starknet. 2025 was Zenith’s inaugural year, and we’re excited for what’s ahead in 2026. A huge thanks goes to our clients, partners, and team for making this possible. Interested in a Zenith audit in 2026? Link in bio!

@meleemarkets 🏇

🏇

From @dreyand_: A security audit is not just the final deliverable - it's also the relationship we build with the team. Every client wants to leave an audit with confidence that what they're building is safe - it's our responsibility as auditors to prove it through: - deep understanding of the business model, - noticing of the right gaps, - finding the right attack vectors and approaching the target from angles that are unexpected (it's not only whitehats that are looking at these products!) - and most importantly communicating it all in a way that gives the client a real image of their security posture.

From @christianvari_: You should never assume that “non-sensitive” or “admin-only” code is safe to ignore. Many critical exploits originate from auxiliary modules, upgrade paths, or operational tooling rather than the main core logic.

We asked a Cybersecurity Olympiad gold medalist, a key contributor to Awesome Solana Security, and a patent author, a simple question. And oh yeah, they’re all Zenith auditors. “What do you wish you’d known when you first started in security research?” Here’s what they said.

Check out the full @cityprotocolHQ audit report below: github.com/zenith-securit…

Zenith Auditors recently completed an audit for City Protocol, an open infrastructure for neofinance, starting from structured products. All findings were resolved/acknowledged. Shoutout to the @cityprotocolHQ team for committing themselves to the highest security standards!

@auryn_macmillan @zellic_io @theInterfold @Uniswap our pleasure 🤝

Shoutout to @zenith256 / @zellic_io for working with us on this. Super quick turnaround to get @theInterfold ready for its @Uniswap CCA.

Check out the @theInterfold audit report below: github.com/zenith-securit…

Zenith Auditors recently completed an audit for The Interfold, an open-source protocol that coordinates Encrypted Execution Environments (E3s). No significant issues were found. Shoutout to the @theInterfold team for committing themselves to the highest security standards!

Stay tuned for more tips, tricks, and advice from Zenith Security Researchers dropping next week. Want an audit from the industry’s top security researchers selected for your specific codebase, security needs, and budget? Visit: zenith.security

From @krikoeth: Do not assume you have found everything until you can't rewrite the codebase from memory. The code always has bugs, you just need to find them.

From @MarioPoneder: I've spent a whole year trying to find clients for my smart contract development services. Bottom line: You need to build your reputation in public to get the necessary visibility and therefore get clients. The auditing experience comes along the way.

These three researchers have: - 300,000+ in total contest earnings - backgrounds in cybersecurity, technical physics, and informatics Now help Zenith clients stay secure every day. So we asked them: What do you wish you knew when you started auditing? Here’s what they said.

We are very lucky to have an esteemed researcher like @christianvari_ on the Zenith roster. If you want an audit from the industry's top security researchers, handpicked for your specific codebase and security needs, we'd love to talk: zenith.security

Tellor Cosmos SDK Chain: 21 critical, 16 major, 24 minor, and 2 informational findings. FeefromReporterStake Function Incorrectly Calculates The feeTracker's TokenOriginInfo.Amount (critical severity). The FeefromReporterStake allows a reporter to use part of its stake to pay the fee for a dispute. However, in the else branch, this TokenOriginInfo is provided with incorrect data. In fact, the Amount is set to unbondAmt, but since this value has already been subtracted in line 125, this is not the actual amount paid with this delegation but the leftover. For example, consider the following scenario: unbondAmt = 100 and there are [10, 40, 50] delegations. The created feeTracker would be equal to [90, 50, 0], which will rebond 140 tokens instead of 100.

250+ audits, 900+ vulnerabilities, €3,000 in scholarships given back into the community. Meet Zenith auditor: @christianvari_ A former software engineer turned full-time security researcher, Christian’s been at this since 2022. This is the @christianvari_ story.