DeFi Protocol by code

On November 2 the SEC staff listed the powers that make a crypto system centrally overseen. Most of them are admin functions you can find in your own contracts. Where teams think they gave those powers up when they didn’t, and three things to have ready before you call your protocol decentralized. Not legal advice.

* Humanity Protocol autopsy: the upgrade key that replaced the contract

* Proxy and upgradeability security checklist (33 checks)

* Signer compromise: multisig, timelocks and MPC

* Krait, free open-source AI auditor

* Solidity audit

* Sources: the SEC staff FAQ and the March 17 interpretation

* Written edition: DeFi Protocol by code #6

Uniswap v4 now routes trades to Curve, Fluid and PancakeSwap through aggregator hooks. What Uniswap’s router checks before it sends trades to a hook, what it doesn’t check, and three things to do before you submit your own.

* Uniswap v4 security guide: hooks, risks and audit path

* Uniswap v4 hook attacks: 4 exploit patterns with PoCs

* Uniswap / AMM / DEX security checklist

* Krait, our free open-source AI auditor

* Solidity audit

* Sources: Uniswap’s launch post and routing guide for hooked pools

* The written edition

Vault deposits passed $10 billion, S&P will score vaults, and Chainlink made cross-chain deposits one click. In this episode: three bugs from a five-chain vault audit, how we found each one and how to test your own code for them, plus a builder question on crediting deposits exactly once.

Mentioned in this episode

* The Yieldcoin case study and the finished report

* ERC-4626 inflation guide

* The written edition, with all the sources

Got a question like this week’s? Reply to the newsletter and I might answer it in a future episode.

Audio edition of the 14 October 2026 issue. Glamsterdam went live on Sepolia and reprices state: new accounts, storage and deployed code all get more expensive. Where hardcoded gas breaks, and three checks before the mainnet fork. Numbers as of 14 October.

Mentioned in this episode

* Ethereum Foundation repricing impact dashboard

* Post-audit security guide

* Upgradeability guide

* Solidity audit

* The written edition

Got a question about your own contracts and the fork? Reply to the newsletter and I might answer it in a future episode.

Audio edition of the 7 October 2026 issue. A Linux update fixed 1,313 CVEs, mostly found with AI, and AI agents now write working exploits for real hacked smart contracts at about $1.22 a run. What that means if you're about to ship, and three things to have ready before you deploy.

Mentioned in this episode

* How our AI audit pipeline finds criticals (Quantus contest write-up)

* Krait (free)

* Post-audit security guide

* Founder Security Sprint

* The written edition

Got a question about your own launch? Reply to the newsletter and I might answer it in a future episode.

Audio edition of the 1 October 2026 issue. S&P Global is buying OpenZeppelin and putting it under S&P Global Ratings. What that means if you're building or raising: the questions diligence already asks, the timing mistake most teams make, and three things to have ready before the first diligence call.

Mentioned in this episode

* Audit ROI: the investor due diligence guide

* The six-stage audit timeline

* Pre-audit checklist

* Krait (free)

* Founder Security Sprint

* The written edition

Got a question about your own security process? Reply to the newsletter and I might answer it in a future episode.