How to find the frequency of more than one zeroes analytically?

Hello, I have to draw the Bode plot of $G(s)=\frac{V_u}{V_{in}}$ and I want to do it without calculating the full transfer function.

This circuit has Cgd=1pF capacitors at every Mos. Vt=0.4V, k=2mA/V^2, and Lambda=0.

I have found the poles at 5.5MHz and 86MHz by a simple visive inspection of the circuit.

I know that the transfer function at $s=\infty$ has a finite non-zero value (0.1), so there must be 2 zeroes.

I can find the first zero by calculating the frequency at which all the current generated from Vin flows into T1 transistor (93MHz), but I cannot find an easy way to calculate the frequency of the second zero (it should be circa 216MHz).

I know I can calculate it through graphic inspection, but I would like to know if there is an easy analytical method as for poles and the Cgd1 zero.

Thank you.

The fast analytical techniques or FACTs can let you determine zeros by inspection. If it works well with passive circuits, it becomes less obvious with controlled sources as in your schematic in which you replace the transistors by their small-signal model. A zero in a transformed network (a network in which caps are replaced by $\frac{1}{sC}$ and inductors by $sL$) is a salient point in the entire $s$-plane (and not only $j\omega$ as in harmonic analysis) where a network in series with the input signal offers an infinite impedance and and/or a branch shunts the signal to ground. See below:
What elements in the input signal path could create a null in the output (meaning there is no current circulating in $R_3$)? What if the parallel combination of $C_2$ and $R_1$ creates an infinite impedance for $s=s_{z1}$? This impedance is equal to $Z_1(s)=R_0\frac{N(s)}{1+sR_1C_2}$. It becomes infinite when the denominator is 0 meaning that the pole of this network is the zero of the circuit under study. Our first zero is $\omega_{z1}=\frac{1}{R_1C_2}$. The second zero is obtained by realizing that the series combination of $C_1$ and $R_2$ creates a transformed short circuit: $Z_2(s)=R_2+\frac{1}{sC_1}=0$ meaning the second zero is the root of this equation hence $\omega_{z2}=\frac{1}{R_2C_1}$. This transfer function is thus partially determined just by inspecting the circuit, without writing a single line of algebra: $H(s)=H_0\frac{(1+\frac{s}{\omega_{z1}})(1+\frac{s}{\omega_{z2}})}{1+b_1s+b_2s^2}$
These FACTs are really great to quickly determine transfer functions of passive and active circuits. The nice thing is that the result is in a low-entropy form meaning it is expressed in a clear and ordered form where poles, zeros and gain are immediately identified. You will find a tutorial on the subject here. Just a final tip to let you check if an energy-storing element contributes a zero or not: if you open-circuit $L$ or short-circuit $C$, does the excitation reach the output? If yes, then you have a zero, if not, no zero. Here, you see that if both $C_1$ and $C_2$ are shorted, the input stimulus reaches the output and creates a response: there are two zeros in this circuit.