IPAL Network Security Assessment
Zealynx audited the IPAL Network knowledge marketplace, a decentralized protocol that mints NFT-gated time-limited access tokens to monetizable knowledge vaults with co-ownership and an upgradeable proxy architecture. The 7-day review identified 18 issues including 1 Critical (vault hijacking via missing access control on setSubscription) and 3 High severity (JSON injection in tokenURI, public setAccess bypass, duplicate subscription entries). 15 findings were fixed and 3 were acknowledged.
Total findings
18
15 fixed · 3 acknowledged
Critical
01
High
03
Medium
03
Low + Info
11
02
Scope
6 files · 629 SLOCInitial commit
46672864c42f
Final commit
80156f6ec201
Platform
Hyperliquid · Solidity
Methodology
File
KnowledgeMarket.sol
KnowledgeMarketV2.sol
ERC4908.sol
KnowledgeMarketProxy.sol
ProxyAdmin.sol
$IPAL token contract
03
Findings
click any row for the full write-upSeverity
ID
Finding
Status
04
Key Findings
- Vault hijacking via missing access control in
setSubscription. ThesetSubscriptionfunction does not verify thatmsg.senderowns the specified vault, letting any address overwrite a vault's subscription terms (price, duration, co-owner) and make private content public without the creator's consent. - JSON injection in
tokenURIenables metadata manipulation. User-controlled strings are concatenated directly into JSON metadata without sanitization, allowing vault owners to inject duplicate keys ("name","description","image") that override the legitimate values displayed by NFT marketplaces and frontends. - Public
setAccessbypasses business logic validation. ThesetAccessfunction on the underlyingERC4908contract ispublic, letting any address modify access controls directly and create state inconsistencies between the platform's subscription tracking and actual on-chain access permissions. - Duplicate subscription entries per vault.
setSubscriptionaccepts multiple calls for the samevaultId, creating duplicate entries invaultOwnerSubscriptions[]while the underlyingsetAccessoverwrites only the latest, leaving orphaned data that breaksgetVaultOwnerSubscriptionsanddeleteSubscriptionsemantics. - Treasury fund accountability gap.
transferFromTreasuryallows the owner to move tokens from the treasury (70% of total supply) without any state tracking, allocation limits, or event emission, leaving token holders with no transparency into how the largest allocation is used.
05
Team & approval
Lead Auditor
Sergio
@Seecoalba
Auditor
Carlos (Bloqarl)
@TheBlockChainer
06
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.
