Plakxio Badge Marketplace: Full Audit and Mitigation Review
Final consolidated audit and mitigation review of Plakxio's badge marketplace contracts and deployment scripts on Base. The 21 October 2026 report covers frozen generation-d: 24 findings, with 20 fixed without the named residuals, two fixed with bounded residuals, one partly addressed with exposure retained by design, and one addressed through agreed documentation. The full report records the scope, verification history and limitations.
Scope
14 filesFindings
click any row for the full write-upFinal report
The final consolidated audit and mitigation-review report is dated 21 October 2026 and is available as a 93-page PDF. It closes this engagement's remediation cycle for the documented scope and frozen revision. The PDF contains the individual finding write-ups, evidence, final dispositions and limitations.
This public copy is the same PDF delivered to the client. SHA-256: 63335d36f0ce89c11e57a4c7df0149426a124b7cfbee56d95329d3560e81d7eb.
Remediation outcomes
The report accounts for 24 findings: 19 from the September full audit and five from the October mitigation re-review. Their severities are 12 Medium, 11 Low and one Informational; none was rated Critical or High. The earlier Founder Security Sprint is a separate engagement and is not added to these totals.
- 20 findings fixed without the named residuals below.
- Two fixed with bounded residuals: L-01 retains a bounded maker nonce exposure; M-11 retains a privileged first-write limitation from zero. These are included in the headline total of 22 fixed findings, with their qualifications preserved in the individual write-ups and PDF.
- One partly addressed, with exposure retained by design: M-12, concerning Special-badge holder protections and administrator trust. Its exact disposition is Partly addressed.
- One addressed through the agreed documentation route: L-10, concerning interface changes. It is shown as Addressed · docs, rather than being presented as a code fix.
No additional blocking defect was identified in the reviewed scope. These conclusions do not mean every risk was eliminated; the retained exposures and evidence limits remain part of the final report.
Reviewed revision and scope
The final mitigation review is bound to generation-d, commit bcf18bb2926589bb8538fa8c322eabc871ff2801. The initial full-audit baseline was d8fa452dc423d00760d3159f290d82b7cc5e1857.
The latest pass assessed seven full-audit/re-review findings and the sprint carryover at generation-d, together with the generation's access-control and retirement changes. Seventeen earlier remediation dispositions are carried from the prior re-review at f020448976eb7c4895e1626ef3228876cff2b7d2, as attributed in Appendix B. This was not a fresh re-audit of the whole tree. The file list above describes the final mitigation-review scope, restricted to those remediations and changes.
Deployment and verification limitations
Deploying to Base mainnet was not required during the audit. Smart-contract code can be reviewed before deployment. The report's mainnet limitation means that the eventual production deployment, configuration, permissions and operations were not independently verified by this engagement; it does not impose a mainnet-deployment prerequisite for the final report.
Two extended retirement harnesses did not complete and are not counted as passes. The affected retirement dispositions rest on the cited code inspection. The agreed 72-hour production-delay rehearsal remains post-review evidence, not a condition for issuance of this report. The PDF identifies client assertions that were not independently verified and records the complete evidence boundaries.
The accurate attribution is Smart contracts audited by Zealynx, linked to this report and its reviewed revision. The assessment is not a blanket approval or security certification for the platform, a future deployment or later code changes.
Team & approval
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.