Results of the second Zealynx Audit Grants round: ten protocols applied across six chains, and every reviewable application received a grant. How the review worked, who won, what the strongest applications had in common, and how to prepare for Season 3.
Carlos (Bloqarl) - October 11, 2026
Season 2 of Zealynx Audit Grants is decided. Ten protocols applied, six chains were represented, and every application we could review left with a grant: one audit fully funded, two at half, and six at the published Builder tier.
This page is the complete record of the round: how the review actually worked, who won and why, what the strongest applications had in common, and what it means for teams considering Season 3.
Zealynx Audit Grants funds smart contract security audits for early-stage Web3 protocols. Grants are percentage subsidies on real Zealynx engagements at our standard, published rate of $6,000 per auditor per week. There are no cash grants, no middlemen, and no separate "grants product": recipients get the same founder-led, senior-only audit our paying clients get.
| Applications | 10 protocols |
| Applications in Season 1 | 8 |
| Chains represented | 6 |
| VC-funded teams among applicants | 0 |
| Reviewable applications receiving a grant | All of them |
| Applications open → close | September 24 → October 4, 2026 |
| Winners announced | October 11, 2026 |
Zero VC-funded teams, again. Independent builders choosing their own auditor is exactly who this program was designed to reach, and two rounds in, it is who it reaches.
Every application was scored against the published 100-point rubric: Protocol Merit (45 points), Product Engagement (40 points), and Independent Builder (15 points). Nothing about the rubric changed after applications opened.
The review is a code review. Every repository was cloned. Line counts were verified against what applicants claimed — and this round, two applications turned out to have understated their scope, one by 2.6×, while not a single one overstated it. Mainnet and testnet deployments were checked on-chain. Private repositories were reviewed under mutual NDA, executed online through the application dashboard.
Beyond the code, Season 2 weighed the business: how original the idea actually is against what already exists, whether there is a route to market, and whether the protocol is something people will use. A clean codebase for a product nobody needs is still a clean codebase, but it is not the same application as a clean codebase with users.
Two corrections were logged during review, both in the applicant's favour, both because a verified fact surfaced that the first pass had got wrong. One applicant flagged that his own shared assessment link was out of date and asked us to look at the current version instead — that turned out to be a real bug on our side, and it is now fixed. Telling your auditor their tooling is wrong is exactly the instinct this program is trying to find.
Covenza — fixed-term, non-liquidating lending against tokenised equities. The principal never reaches the borrower's wallet: it sits in a per-loan vault they can trade within but cannot drain, with TWAP-bounded settlement instead of an oracle and losses cascading through deposit, then insurance, then lender. Weekend-aware grace periods on a tokenised stock are the detail that gives it away — this is someone who thought past the mechanism to how the underlying asset actually behaves. It was also the only application in the cohort whose line-count claim matched our measurement exactly.
Coffer — a validator issues fixed-term ETH bonds as NFTs against its own stake. The contract is set as the validator's withdrawal credentials, so if a bond goes unpaid, anyone can force-exit the validator via EIP-7002 and the stake repays holders. No oracle, no governance, no upgrades. Using withdrawal credentials as the collateral enforcement mechanism converts a passive staking position into collateral without a custodian, a pool, or a price feed, and we have not seen it done elsewhere.
BitChill — non-custodial Bitcoin DCA on Rootstock, where stablecoins earn yield between purchases and purchased rBTC is claimable only by its owner, with no governance or owner path that can redirect it. The only Season 2 applicant with users, volume and history rather than a launch date: 75 users, over 1,000 recurring purchases, and nearly two years of continuous work.
Interest Exchange — interest rate swaps that let borrowers exchange variable-rate debt for fixed, with adapters across major lending markets and a tick-based system so borrowers do not prepay the fixed rate. The largest codebase of the round.
Moonz — a Solana launchpad whose Program Controlled Liquidity Switch moves the active pool between SOL and USDC under on-chain rules rather than operator discretion.
rwtexchange — an over-collateralised peer-to-peer marketplace for real-world-tradeable game assets, where both sides post collateral above trade value, so settlement is fast and the protocol always has something to seize.
SatoshiYields — sBTC yield aggregation on Stacks, with a modular Clarity vault routing into lending and liquidity venues. Already live on mainnet in an earlier version, with the next release gated on this audit.
Voxscape — an on-chain 3D city game with voxel claims, commit-reveal siege mechanics and a deterministic on-chain adversary. The tightest scope of the round and, by some distance, the best engineering behaviour we saw: told that one incentive bug might have siblings, the team reproduced it, changed the resolution rule, and left regression tests named after the failure mode.
Kanshi Guardian — multi-chain wallet security: drainer and approval warnings before signature, forensic tracing for victims, and vault contracts with timelocked controls. Built by a founder who started after being defrauded in a presale and tracing the funds himself.
Season 1's Builder Grants were published at 25% and then upgraded, all of them, to 50%. That upgrade was described at the time as "One time, in return for the trust these teams placed in a first-season program", and it was meant literally. Season 2 runs the tier structure as published.
That is worth being plain about, because recipients compare notes across seasons. A Builder Grant at 25% is not a judgement on the applicant — this was a stronger field than Season 1 on scope, on honesty of claims and on business substance. It is the published structure operating as written, which is the only way a programme like this stays credible across seasons.
What moves an application up a tier is evidence that the audit will be acted on rather than filed: a frozen scope, a launch that genuinely depends on the review, and a team that treats a hostile finding as information. Those are learnable, and they are what Season 3 will reward.
Season 2 doubled Season 1's field with zero paid distribution on the winning channel, and raised the floor on application quality while doing it.
If you are building a protocol where a serious audit is the blocker between you and launch:
Questions about Season 2 or Season 3: contact@zealynx.io.