Hyperlines TypeScript Audit and Pentest
Zealynx ran a five-day TypeScript audit and penetration test of the Hyperlines TypeScript applications (liqhub-v2 and trendln-v3) developed under the IPAL Network umbrella. Coverage included the Next.js frontend, Node.js backend, MongoDB and Redis layers, WebSocket transport, and Hyperliquid integration paths. Eleven issues were identified: three High (JWT cookie without HttpOnly/Secure/SameSite flags enabling token theft and CSRF; agent private keys persisted in localStorage; CORS misconfiguration with credentials and reflected origin on third-party analytics API), seven Medium (hardcoded WebSocket endpoints without integrity, unvalidated profile fields, MongoDB without explicit TLS enforcement, missing security headers, three reflected-parameter XSS vectors), and one Informational (sensitive object logging). Ten findings were fixed; one (MongoDB TLS hardening) was acknowledged.
Scope
2 files · 5,425 SLOCFindings
click any row for the full write-upKey Findings
- JWT cookie set without security flags, enabling token theft and CSRF (H-01, fixed). The session JWT was stored in a cookie without
HttpOnly,Secure, orSameSiteattributes, making it readable by client-side JavaScript and exposed to CSRF. Any XSS or malicious third-party script could exfiltrate the token directly viadocument.cookie. - Agent private keys persisted in localStorage (H-02, fixed). The app generated trading-agent private keys on the client and stored them in localStorage. Any XSS or compromised browser extension could exfiltrate keys and drain funds or impersonate users.
- CORS misconfiguration on third-party API with reflected origin and credentials allowed (H-03, fixed). The Segment.io analytics endpoint reflected the
Originheader while allowing credentials, enabling arbitrary websites to make authenticated cross-origin requests and potentially exfiltrate user data. - Seven Medium findings covered hardcoded WebSocket endpoints without integrity checks, unvalidated profile fields written to MongoDB, missing explicit TLS enforcement on MongoDB connections (acknowledged), missing security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy), and three separate reflected-parameter XSS vectors across the URL handling layer.
- One Informational finding flagged sensitive objects being logged to the browser console.
Ten findings were fixed; the MongoDB TLS hardening (M-03) was acknowledged as part of broader infrastructure hardening planned outside this engagement.
Team & approval
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.