Nexalo Smart Contract Audit
Zealynx audited Nexalo, an autonomous on-chain raffle protocol with six raffle products, Chainlink VRF for provably fair draws, multi-level referral commissions, NXL token vesting schedules, proportional staking rewards, and a BTC-backed treasury. The 4-day review identified 22 issues including 3 Critical (private key exposure, NXL distribution failure causing fund lockup, snapshot-balance manipulation), 5 High (ticket ownership overwrite, flawed staking reward distribution, locked stablecoins, diluted rewards, and broken ticket index continuity), 10 Medium and 4 Low. 14 findings were fixed; 8 were acknowledged or resolved by removing the feature.
Total findings
22
14 fixed · 8 acknowledged
Critical
03
High
05
Medium
10
Low + Info
04
02
Scope
6 files · 1,150 SLOCFile
NexumManager.sol
ReferralNetwork.sol
AmbassadorRegistry.sol
NXLToken.sol
NexaloStaking.sol
TreasuryBTC.sol
03
Findings
click any row for the full write-upSeverity
ID
Finding
Status
04
Key Findings
- Private key in plain sight in
.env. Sensitive credentials including API keys and private keys were committed to environment files in the repository, exposing critical secrets to anyone with repository access. All keys required immediate rotation and the.envfile added to.gitignore. - NXL distribution failure causes permanent fund lockup.
buyTickets()andbuySpecificTickets()accept payment and assign tickets before distributing NXL rewards. When NXL is exhausted,_distributeNXL()deactivates the product mid-transaction, leaving rounds incomplete with funds permanently trapped and no recovery mechanism. TreasuryBTC::claimRewardsmanipulation via livebalanceOf(). Reward claims use live NXL balances at claim time instead of snapshot balances, allowing users to transfer NXL between addresses and claim the same snapshot rewards multiple times, draining the TreasuryBTC contract.- Ticket ownership overwrite in
NexumManager::buyTickets. Sequential ticket assignment does not check existing ownership. Tickets previously bought viabuySpecificTicketsat high indices can be overwritten by sequential purchases, allowing attackers to steal ticket ownership and claim prizes intended for other buyers. - Flawed reward distribution causes pool depletion and DOS in
NexaloStaking. Rewards are calculated independently per user using hardcoded USD values rather than proportionally to the available WBTC pool, causing reward sums to exceed the pool balance and DoSing all subsequent stakes and unstakes. - Broken ticket index continuity violates
product.maxTicketsinvariant.buySpecificTicketsallows non-consecutive ticket numbers but only incrementsround.ticketsSoldby count, creating gaps in ownership. The protocol can select winners from unowned indices, sending rewards toaddress(0).
05
Team & approval
Lead Auditor
Carlos (Bloqarl)
@TheBlockChainer
Auditor
Stephen
@derastephh
Auditor
Springfield Yonga
@0xspryon
Auditor
Strapontin
@0xStrapontin
06
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.
