Plakxio, built by Vivid Verde Digital LLC, is a gasless marketplace for football match badges on Base. Buyers and sellers sign orders off-chain and never send a transaction or hold gas; a platform relayer submits and pays for every settlement. One-of-one Special badges trade separately, through an ascending floor that ratchets on each sale.
Zealynx carried out a full audit of Plakxio, a gasless marketplace for football match badges on Base, following the two-day Founder Security Sprint on the same codebase. The engagement covered all seven contracts under src/ and, for the first time, the ten deployment and operational scripts under script/, because deploy-time and retirement-time actions are load-bearing assumptions of the contracts. The report and findings will be published once remediation has been reviewed.
Zealynx reviewed Plakxio, a gasless marketplace for football match badges on Base, in a two-day Founder Security Sprint against a frozen tag. The scope was the three contracts and their supporting sources: PlakxioBadge, an ERC-1155 walled garden where only a whitelisted settlement contract may move a badge; PlakxioSettlement, which matches relayer-submitted EIP-712 asks and bids and takes payment through EIP-3009 authorizations; and PlakxioSpecialMarket, which runs the ratcheting floor for one-of-one Special badges. The sprint identified 16 issues, including 2 High: any whitelisted operator could take any holder's badges, and a freshly claimed Special was purchasable at a global dust floor. Every finding at Medium or above is backed by a proof-of-concept test paired with a negative control. A remediation review against the next tag found 13 fixed and verified and 3 accepted as risks with reasoning; in two of those three the client argued from their own code and corrected this report, and the corrections are recorded.
When someone asks “is Plakxio really audited?”, this is the page to send them. Every engagement we’ve delivered, in one place, with the artifacts.