Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
Engagement record · attribution first

Case studies.

A report tells you what was found. A case study tells you how it was found — the system, the invariant under pressure, the reasoning that got there, and who actually did the work. Published only against evidence records.

Material engagement claims are linked to evidence records. Work delivered through a partner security firm is labelled as such, with the firm named and the exact role stated.

Audit records
49
Protocols
42since 2023
Partner firms
6

Two kinds of engagement

Never blurred

Direct Zealynx engagement

The protocol contracted Zealynx. We set the scope, ran the review, wrote the report, and own the outcome end to end.

CLIENT
The protocol, named directly
REPORT
Published by Zealynx

Delivered through a partner firm

The protocol contracted another security firm. Carlos worked the engagement as part of that firm’s team. Real proof of work — and never described as our client.

CLIENT OF
The named partner firm
CodespectComposable SecurityCyfrinPashov Audit GroupSherlockShieldify

What a case study contains

Fixed structure
01AttributionDirect or partner, firm named
02System contextWhat the code actually does
03Security challengeThe hard part of the review
04InvariantThe trust boundary under test
05ApproachHow the question was attacked
06OutcomeWhat was found, or ruled out
07RemediationThe fix, and how it was verified
08Reusable lessonWhat it teaches other teams
09Public evidenceLinks anyone can check
10Next stepWhere a buyer goes from here
5 of 5
YieldcoinArbitrum · Ethereum · Base · Optimism · Avalanche · Solidity
Sep 2026

Direct Zealynx engagement

Yieldcoin: When Crosschain Recovery Cannot Recover

Vaults / Yield

A five-chain vault audit exposed receiver replay, permanent recovery loops, and accounting gaps across CCIP, CRE, and lending adapters.

INVARIANT
Every accepted crosschain command must be bound to its intended destination, preserve accounted value, and have a terminal path back to progress.
OUTCOME
The public record reports 11 findings: 8 fixed, 2 mitigated, and 1 accepted with documented residual risk.
Lead smart contract security review team3 evidence records
PlakxioBase · Solidity
Aug 2026

Direct Zealynx engagement

Plakxio: Restoring Consent to ERC-1155 Transfers

NFT

A trusted-operator shortcut bypassed holder consent. The retest verified code-only operators, delayed activation, and an enforceable opt-out.

INVARIANT
Only a consent-enforcing settlement contract may move a holder's badge, and a holder's explicit opt-out must remain effective.
OUTCOME
The remediation review verified code-only operators, delayed activation, and holder opt-out enforcement on single and batch transfers.
Lead smart contract security review team3 evidence records
Yada CoinBNB · YadaCoin · Solidity
Mar 2026

Direct Zealynx engagement

YadaCoin Bridge Audit: Transaction-Level Backing

Bridges / Cross-chain

A bridge audit showed why local checks were not enough to preserve transaction-level backing, token identity, and key continuity.

INVARIANT
Wrapped supply must remain fully backed, and every bridge operation must preserve the intended token identity and authorization chain.
OUTCOME
The public report marks all 28 findings as fixed.
Smart contract security review team2 evidence records
Neverland MoneyMonad · Solidity
Aug 2025

Delivered through Composable Security

Neverland: Testing an Early-Exit Penalty Invariant

Lending

A veNFT transfer made an early-exit penalty read as zero. The retest verified a calculation path that no longer depended on the transfer guard.

INVARIANT
An early withdrawal must apply the configured penalty regardless of a same-block veNFT ownership change.
OUTCOME
Composable Security's August 14, 2025 retest marks the critical penalty-bypass finding fixed.
Carlos (Bloqarl) contributed as a contractor auditor on the two-person review team3 evidence records
Bastion WalletEthereum · Solidity
Mar 2024

Delivered through Shieldify Security

Bastion: Testing ERC-20 Subscription Payments

Account Abstraction

A recurring-payment path held the tokens yet used transferFrom on itself. The review traced custody, authority, execution, and the recorded fix.

INVARIANT
A valid recurring ERC-20 payment must move tokens from the contract that holds them to the subscription initiator without requiring that contract to approve itself.
OUTCOME
The public report records the transferFrom-to-transfer correction as acknowledged and fixed.
Zealynx Security contributed as co-auditor; Shieldify Security led the review and owned the client relationship.3 evidence records

Evaluating an audit partner?

Read a finished report end to end, or send the scope and get a written plan back — not a brochure.

Browse auditsRequest an audit →