DeFi · DeFi integration & security lab · 2026Verified on Base Sepolia
Zapline
A hardened Uniswap V2 integration suite, with a lab that reproduces four real DeFi exploits and the defense for each.
- Tests
- 109 across 12 suites
- Attack PoCs
- 4 exploits + fixes
- Deployed
- 7 verified contracts
- Math
- 512-bit safe sqrt
01 The problem
Most DeFi losses don't come from exotic bugs. They come from integrations: spot-price oracles, missing slippage checks, unauthenticated callbacks and vault inflation. Knowing the defenses means knowing the attacks.
Zapline is a protocol layer around Uniswap V2: a router, single-sided zaps, a TWAP oracle, an ERC-4626 LP vault and a flash-swap arbitrage contract. Next to it sits an attack lab that exploits naive versions of each pattern, then shows the defended version holding up.
02 How it works
Hover or tap a step
03 What I built
- 01SwapExecutor: a multi-hop router with strict slippage and deadline enforcement.
- 02Zap + ZapMath: single-sided liquidity using a closed-form quadratic solved with a 512-bit safe Newton-Raphson square root.
- 03TwapOracle: a 256-slot ring-buffer time-weighted price oracle.
- 04LPVault: an ERC-4626 vault priced with the fair-reserve formula and a virtual-share offset.
- 05FlashSwap: cross-venue arbitrage with triple-lock callback authentication.
- 06Attack PoCs for spot-oracle manipulation, sandwiching, flash-callback drains and first-depositor inflation, each paired with its fix.
04 Key decisions
- Fair-reserve pricing instead of spot reserves, so the vault can't be manipulated by a single large swap.
- Full-precision maths for the zap split to avoid rounding dust and overflow at large reserves.
06 Verify it on-chain