External contractor

This audit was performed by Carlos (Bloqarl) as an external contractor at Shieldify, prior to or alongside founding Zealynx Security. It is not a Zealynx engagement, but is included here as part of Carlos’s professional security record.

Awaiting publication

This audit is part of the Zealynx portfolio. Full details are being prepared for publication. Engagement scope and outcome available on request in the meantime.

PPear · Smart Contract Security AssessmentPear Client Hub

Pear Vault Service

Zealynx reviewed the Pear vault service, the NestJS backend that isolates Privy credentials and owns all vault-related state for Pear's Hyperliquid ecosystem, delivered as an external contractor engagement for Shieldify. The review covered the full custody and signing surface: EIP-712 request authentication and RS256 JWT verification, the Privy-backed agent-wallet signing path used to sign Hyperliquid orders, vault creation and deactivation workflows on HyperEVM, agent operations such as approvals, unified-account configuration and swap-and-transfer, the deposit and withdrawal event indexer, and the NAV poller behind the chart APIs. Emphasis was placed on what a compromised or merely over-privileged caller can sign, on authority that outlives the role that granted it, and on the atomicity of workflows that move funds across the service, Privy and the chain. Findings were raised as issues throughout the engagement, each labelled with a severity and an evidence level recording whether it was demonstrated against the running service or established by source analysis. Mitigation review is underway; the report and findings are being prepared for publication.

HyperliquidTypescriptSmart Contract Code Review2026-08-03Zealynx methodology

Total findings

0 fixed

Critical

High

Medium

Low + Info

Scope

12 files

Platform

Hyperliquid · Typescript

Methodology

Zealynx audit methodology

Out of scope

consumer services (pear-hyperliquid-engine, pear-pro-backend), trading logic and signal generation, Privy and Hyperliquid as third-party platforms, on-chain vault contracts

File

src/auth/ (EIP-712 guard, RS256 JWT verification)

src/signing/ (Privy EIP-712 order signing)

src/vaults/ (vault CRUD, agent operations, custody workflows)

src/vault-api-wallet/

src/agent/

src/bridge/

src/events/ (deposit and withdrawal indexer)

src/nav/ (NAV poller and chart APIs)

src/chain/ (HyperEVM RPC, vault factory deployment)

src/hyperliquid/

src/health/, src/config/, src/prisma/

prisma/schema.prisma and migrations

Findings

click any row for the full write-up

Findings are being prepared for publication.

Team & approval

Lead Auditor

Carlos (Bloqarl)

@TheBlockChainer

Disclaimer

This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.