This audit was performed by Carlos (Bloqarl) as an external contractor at Pashov Audit Group, prior to or alongside founding Zealynx Security. It is not a Zealynx engagement, but is included here as part of Carlos’s professional security record.
Initia Widget and Router API Security Review
Time-boxed security review of the initia-labs/widget repository — Initia's React SDK for wallet connections, bridging, and transaction signing, plus the Router API (TypeScript proxy for Skip API with Initia-ecosystem extensions). Conducted by Pashov Audit Group (defsec, Bloqarl, 5m477, Shurikenzer) over June 17-23, 2025, with Carlos (Bloqarl) participating as a contractor. Twenty-eight issues were identified: five Medium (raw request chain to external service, unvalidated external image URLs from NFT metadata, stale SigningStargateClient on account change, inadequate URL protocol whitelist in link sanitization, XSS via unfiltered src in img.initia.xyz proxy endpoint) and twenty-three Low covering token approval handling, fee enforcement, Docker and Kubernetes hardening, LayerZero gas limits, IBC packet sizing, security headers, CORS, TLS versions, HTTP timeouts, NFT metadata validation, and various input validation gaps. Fix review commit: de9d3602dc1afcb40312cadf12c6dbf1fb1a1169. Five Medium resolved; nine Low resolved; fourteen Low acknowledged.
Scope
11 filesFindings
click any row for the full write-upKey Findings
- Five Medium findings (all resolved). Raw request chain to external service (open proxy to Skip API), unvalidated external image URLs from NFT metadata, stale
SigningStargateClientwhen changing accounts, inadequate URL protocol whitelist in link sanitization, and XSS possible via unfilteredsrcparameter in theimg.initia.xyzproxy endpoint. - Twenty-three Low findings. Covered ERC-20 approval failure handling, fee validation that was calculated but not enforced, Docker image running as root, missing Kubernetes security controls (container escape risk), fixed gas limits in LayerZero causing transaction and fund locks, information disclosure through console logging, tabnabbing in external links, missing security headers, overly permissive CORS, X-Powered-By header leaking technology stack, oversized packets in ORDERED IBC channels causing channel closure, missing
awaitinErc20Service, improper exception types in OP bridge check, lack of validation on NFT metadata inWithNormalizedNft, no response validation for external Skip API, insecure TLS 1.0/1.1 on public endpoints, missing HTTP request timeouts in axios clients, unhandled exceptions inquantitySuperRefine(), missing curve validation inencodeEthSecp256k1Pubkey, insufficient confirmation depth for reorg protection, unescaped NFT metadata inCollectionDetails.tsx, and unvalidated wallet image sources. - Fix outcomes. All five Medium findings resolved by Initia. Nine Low findings resolved; fourteen Low findings acknowledged as known limitations or out-of-scope hardening items.
For the full per-finding write-up, see the original Pashov Audit Group report PDF.
Team & approval
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.