Amana DeFi
Founder and Technical Lead
August 2024 – September 2025
Amana was mine. I founded it, raised for it, designed the architecture, wrote the protocol layer, and closed it. It ran from August 2024 to September 2025.
The idea was to make cross-chain yield boring for the user: deposit an asset on whatever chain you happen to hold it, and have the capital routed to the best available strategy somewhere else, with the accounting handled for you. ZetaChain provided the cross-chain messaging layer; the vaults and the routing were ours.
What I built
15,488 of 16,425 lines of Solidity — 94% — with 100 of 116 contracts entirely mine, and 871 of 892 commits to the contract codebase. A frontend and product team of five to eight built around it; the protocol layer was mine alone.
- Vault core — upgradeable ERC-4626 vaults plus connected-chain vaults, so a deposit on one chain and a strategy on another stay in the same share accounting.
- Cross-chain withdrawal infrastructure, which is the hard half. Withdrawal is not the inverse of deposit: the funds are sitting in a strategy on a remote chain, so a request has to be accounted for locally, executed remotely, and settled back, while share accounting stays correct the whole way through and nothing double-counts.
- 21 yield strategies over a shared base — Convex, Compound, Aave, Curve, Balancer, Fluid and generic ERC-4626 wrappers.
- Eight chain-specific swap helpers, a price-oracle layer, treasury and gas management.
- 9,309 lines of tests.
Deployed across six mainnet chains: Ethereum, Arbitrum, Polygon, BNB Chain, Base and ZetaChain.
We raised a USD 100,000 grant and USD 150,000 in initial investment, and exceeded USD 250,000 in TVL. I took the protocol through external audit with Linum Labs, having run static analysis in-house beforehand.
How it ended
In August 2025 Amana was exploited. The vulnerability was real and it was in code I wrote. Our published statement at the time set out what happened and what we had missed: a function capable of moving funds between strategies was not sufficiently access-controlled, and an additional audit I had been pushing for had not yet been scheduled. Once I saw it, the hole took under an hour to close.
Every affected user was reimbursed in full, from the treasury. I absorbed a share of the loss personally. Our investor and host chain withdrew support shortly afterwards, and I took the decision to wind the project down rather than run it on diminished foundations.
I am not going to dress that up. A protocol I architected lost user funds, and the specific control that would have prevented it is one I understood and had not enforced.
What I would want anyone to take from it is what I did next rather than how I felt about it. Two months away from full-time work, and then a deliberate rebuild of how I approach verification — internal review before external audit, invariants stated explicitly rather than assumed, independent checking at every step where I had previously trusted my own reading. Every part of the security practice on this site post-dates August 2025. I did not choose security as a specialism. It chose me, expensively.