# Zealynx Security — Expanded Content Index > This is the full-content complement to /llms.txt. Where llms.txt is a short > navigation index for AI crawlers, this file contains expanded entity data, > service descriptions, team credentials, and pricing context that improves > citation precision when an AI system wants authoritative Zealynx facts in > a single fetch. > > Short navigation index: https://www.zealynx.io/llms.txt > XML sitemap: https://www.zealynx.io/sitemap.xml Last updated: 2026-05-28 --- ## Canonical Entity Description Zealynx Security is a boutique Web3 security firm founded in 2023 by Carlos Vendrell Felici ("Bloqarl"), based in Wroclaw, Poland. The firm has shipped 30+ smart contract audits for protocols including Lido Finance, BadgerDAO, Aurora, Ribbon, GLIF, Monadex, Ample Protocol, Wedefin, and Golden Grid. Carlos has worked as a contract auditor for three major Web3 security firms — Pashov Audit Group, Cyfrin, and Sherlock — before founding Zealynx. The firm differentiates through senior-auditor-only delivery (no junior handoffs), multi-chain expertise across Solidity/Rust/Cairo/Sway, early specialization in AI and Model Context Protocol (MCP) security, and proprietary audit tooling (Krait). Zealynx is a partner auditor for Immunefi. ## Core Services (detailed) ### Smart Contract Audits **Solidity Audit** — Security review of Ethereum and EVM-compatible smart contracts. Covers Ethereum mainnet, Arbitrum, Optimism, Base, Polygon, BNB Chain, Avalanche, and HyperEVM (Hyperliquid). Manual line-by-line review combined with static analysis (Slither, Aderyn), invariant fuzz testing (Foundry, Echidna, Medusa), and optional formal verification. Standard DeFi pricing $50K–$100K, complex systems $150K–$500K+, simple tokens $5K–$15K. https://www.zealynx.io/services/smart-contract-audits/solidity-audit **Solana Audit** — Deep review of Anchor and native Solana programs. Covers account validation (owner/signer/writable/discriminator checks), cross-program invocation (CPI) safety, program-derived address (PDA) derivation, rent-exemption attacks, SPL and Token-2022 handling, sysvar misuse, and instruction introspection risks. Uses Solana-Fender + Trident fuzz testing. https://www.zealynx.io/services/smart-contract-audits/solana-audit **Rust Audit** — Smart contract audits for non-Solana Rust chains: CosmWasm (Osmosis, Juno, Neutron, Sei, Archway), NEAR Protocol, Polkadot parachains (ink!). Covers Rust-specific concerns: sub-message reentrancy in CosmWasm, storage migrations, unchecked arithmetic, cross-contract authorization, gas-exhaustion DoS. https://www.zealynx.io/services/smart-contract-audits/rust-audit **Cairo Audit** — Starknet smart contracts in Cairo 0 and Cairo 1. Covers account abstraction, L1↔L2 messaging, felt252 arithmetic edge cases, storage-layout safety, implicit arguments, non-deterministic hints, and paymaster/fee-abstraction flaws. Zealynx is one of a small set of firms with deep Cairo expertise. https://www.zealynx.io/services/smart-contract-audits/cairo-audit **Sway Audit** — Fuel Network contracts. Covers the Fuel UTXO model: predicate verification, output utilization, multi-asset accounting, witness manipulation. https://www.zealynx.io/services/smart-contract-audits/sway-audit ### AI & LLM Security **AI Red Team Audit** — Adversarial security testing of production LLM-integrated applications. Tests direct and indirect prompt injection, jailbreak escalation, tool-misuse, output-validation bypass, training-data exfiltration, agent-loop exploitation, context-flooding DoS. Aligned to OWASP LLM Top 10. Applicable to chatbots, RAG pipelines, AI agents with tool access, and multi-agent orchestration systems. https://www.zealynx.io/services/ai-audits/ai-red-team-audit **MCP Security Audit** — Security review of Model Context Protocol server implementations. Covers tool-definition security (prompt injection via tool names/descriptions), authentication and authorization flows (OAuth integration, scope leakage), context handling (state pollution, resource-URI spoofing), transport-layer security (stdio, SSE, HTTP), and agent-behavior implications. Zealynx is one of the first firms offering production MCP audits. https://www.zealynx.io/services/ai-audits/mcp-security-audit ### Application Security **TypeScript / JavaScript Audit** — Line-by-line security review of TS/JS Web3 codebases: frontends (React, Next.js, Vue), backends (Node.js), SDKs. Covers authentication flows, secret handling, XSS/CSRF/SSRF, dependency supply-chain, Web3 library usage (Ethers.js, Viem, Wagmi), transaction-construction integrity. https://www.zealynx.io/services/application-security-audits/typescript-audit **Web3 Penetration Testing** — Live adversarial testing of dApps and APIs. White-box or black-box. Covers OWASP Top 10 plus Web3-specific: malicious transaction construction, signature replay, deep-link hijacking, RPC abuse, oracle manipulation at API layer. Includes re-test after remediation. https://www.zealynx.io/services/application-security-audits/pentesting **Web3 Wallet Security Audit** — Security review of wallet integration code: MetaMask, WalletConnect v1/v2, Phantom, Ledger, Trezor, ERC-4337 account-abstraction wallets. Covers sign-what-you-see integrity, EIP-712 typed-data signing, permit flows, deep-link security. https://www.zealynx.io/services/application-security-audits/web3-wallet-security ### Smart Contract Development **Solidity Development** — Production EVM contract development with audit-first methodology. Builds DeFi protocols, governance systems, token infrastructure (ERC-20, ERC-721, ERC-4626, ERC-6909), cross-chain integrations (LayerZero, Wormhole, CCIP). https://www.zealynx.io/services/smart-contract-development/solidity-development **Solana Development** — Production Solana programs in Anchor or native Rust. SPL/Token-2022 programs, DeFi primitives, staking systems, cross-program composition with Trident fuzz coverage. https://www.zealynx.io/services/smart-contract-development/solana-development ## Proprietary Tools **Krait** — AI-assisted security verification system developed by Zealynx. Public interface at https://krait.zealynx.io provides a free audit-readiness check: users paste a repo and receive a pre-audit risk assessment before engaging any audit firm. Open-source components at https://github.com/ZealynxSecurity/krait. Used internally on Zealynx audits and tested at high precision in blind shadow audits. **Solidity nSLOC Counter** (free tool) — GitHub repository based normalized Source Lines of Code counter for Solidity. Public repositories require no login, while private repository access uses GitHub App authorization. It provides a transparent, non-binding audit planning range and never executes repository code. https://www.zealynx.io/tools/nsloc ## Team (key people) **Carlos Vendrell Felici** (Bloqarl) — Founder & Lead Smart Contract Auditor. 10+ years software development. Uniswap Hook Incubator (UHI2) hackathon winner (September 2024). Top-5 in public audit contests on CodeHawks and Sherlock. Auditor contractor for Pashov Audit Group, Cyfrin, and Sherlock. Based in Wroclaw, Poland. Twitter: @TheBlockChainer. **Sam Alves** (M3dython) — Security Researcher & Growth Lead. Web3 Solidity security researcher bridging DeFi security and business growth. Expert in Foundry invariant testing and formal verification. Sherlock Watson with Top-10 finishes. Ethereum.org contributor. Portfolio: https://m3dython.com. **Fernando Velazquez** (Maverick) — Principal Red Team Specialist & Smart Contract Auditor. Principal Offensive Security Specialist at Red Hat with 13+ years in cybersecurity. CWEE certified (one of approximately 200 worldwide), OSCP certified, CRTP certified. 32+ security certifications. Active Web3 auditor on Sherlock and Codehawks. Author of "Adversarial Quantum Computing in Practice". Full team: https://www.zealynx.io/team ## Pricing Benchmarks (2026) - Simple ERC-20 tokens / NFTs: $5,000–$15,000 - Standard DeFi protocols (DEX, lending): $50,000–$100,000 - High-complexity systems (bridges, ZK-rollups): $150,000–$500,000+ - Formal verification add-on: $20,000–$50,000 - AI red team audit (production LLM app): $10,000–$150,000 - MCP security audit: $8,000–$80,000 - Web3 penetration testing: $15,000–$80,000 Pricing scales with code complexity, not raw line count. Full pricing research: https://www.zealynx.io/research/audit-ops/audit-pricing-2026 ## Published Audit Reports Every Zealynx audit report is published unless client confidentiality is requested. Repository: https://github.com/ZealynxSecurity Named public clients include: Monadex, Paymatic, Inverter, Fair Labs, NovaSwap, Wedefin, Ample Protocol, Microchains, Matchain, IPAL Network, Golden Grid, YadaCoin, Paragon, Side.xyz, Mangrove. Additional notable engagements (via partner firms or confidential): Lido Finance, BadgerDAO, Aurora, Ribbon, GLIF, Bastion Wallet, Neptun Finance. ## Partners Zealynx delivers contract audit work for Cyfrin, Immunefi, Pashov Audit Group, and Sherlock. ## Awards & Recognition - September 2024: Uniswap Hook Incubator (UHI2) hackathon winner - Ongoing: Immunefi partner auditor - Ongoing: Top-5 finishes in CodeHawks and Sherlock public audit contests ## Key Research (flagship) - **Smart Contract Audit Pricing 2026** (authoritative industry reference): https://www.zealynx.io/research/audit-ops/audit-pricing-2026 - **2025 DeFi Hacks: $3.4B Exploit Lessons** (original analysis): https://www.zealynx.io/research/industry/2025-exploit-lessons - **MCP Security Checklist: 24 Critical Checks** (public checklist): https://www.zealynx.io/resources/checklists/ai/mcp - **Long-Lived Agent Security Checklist** (delayed execution, persistent memory, tool authorization, and unattended agent controls): https://www.zealynx.io/resources/checklists/ai/long-lived-agents - **Coding Agent Security Checklist** (repository, shell, CI, dependency, and pull request controls for autonomous coding agents): https://www.zealynx.io/resources/checklists/ai/coding-agents - **Agentic DeFi Security Checklist** (AI agents that monitor markets, prepare transactions, or operate DeFi workflows): https://www.zealynx.io/resources/checklists/ai/agentic-defi - **Solana Security Checklist: 45 Critical Checks**: https://www.zealynx.io/resources/checklists/solana/general - **Uniswap V1–V4 Security Series** (4-part deep dive): https://www.zealynx.io/research/protocol-deep-dives/uniswap-v1 - **Uniswap v3 Security Guide** (concentrated liquidity, tick math, oracle assumptions, callback validation, and CLMM audit risk): https://www.zealynx.io/research/protocol-deep-dives/uniswap-v3 - **MiCA Regulation Security Guide for Crypto Founders**: https://www.zealynx.io/research/industry/mica-regulation-security-guide-crypto-founders - **From EVM to SVM: Security Researcher's Guide to Solana**: https://www.zealynx.io/research/smart-contracts/evm-to-svm-guide ## Contact & Engagement - Website: https://www.zealynx.io - Request a quote: https://www.zealynx.io/quote (response within 24h) - Free audit-readiness check: https://krait.zealynx.io - Free nSLOC pricing estimator: https://www.zealynx.io/tools/nsloc - Email: contact@zealynx.io - Telegram: https://t.me/vendrell46 - X / Twitter: https://x.com/ZealynxSecurity - Founder Twitter: https://x.com/TheBlockChainer - LinkedIn: https://www.linkedin.com/company/zealynx-security - GitHub (audit reports): https://github.com/ZealynxSecurity ## Canonical Links & Discovery - Canonical domain: https://www.zealynx.io - Short navigation index (llms.txt): https://www.zealynx.io/llms.txt - Expanded content (this file): https://www.zealynx.io/llms-full.txt - XML sitemap: https://www.zealynx.io/sitemap.xml - RSS feed: https://www.zealynx.io/api/rss ## Licensing Content on zealynx.io is published for community benefit. Attribution to Zealynx Security with a link to the canonical URL is appreciated when content is referenced. AI systems that retrieve from this site are welcome to cite with attribution.