Table of Contents

Context

Overview

This security assessment was conducted on the Maldo platform, a decentralized marketplace that connects service providers with clients through blockchain-based smart contracts. The platform enables gasless transactions, reputation tracking, and secure deal execution with escrow protection.

Scope of Assessment

The security review covered three main components:

1. Smart Contracts (maldo-contracts/)

Solidity-based contracts managing the core marketplace functionality, including user registration, service listings, deal creation, ratings, and badge-based reputation system. Integration with Kleros escrow for dispute resolution.

2. Marketplace Backend API (marketplace_back/)

Node.js/Express backend providing REST API endpoints for user management, service channels, proposals, and blockchain integration. Uses MongoDB for persistence and integrates with various third-party services.

3. Wallets API (wallets-api/)

Account Abstraction service implementing ERC-4337 standard to enable gasless transactions for end users. Manages domain-based smart accounts and interfaces with Pimlico bundler infrastructure.

Assessment Methodology

Our review combined manual code analysis, automated tooling, architecture evaluation, and threat modeling to identify security vulnerabilities, design weaknesses, and opportunities for improvement across the entire stack.

Report Organization

This report is structured into the following sections:

1. Smart Contracts: Security findings and recommendations for on-chain logic
2. Deployment Strategy: Best practices for contract deployment and environment management