Audit name:
[PT] Beldex | WEB+API | Jul2026
Date:
Aug 3, 2026
Table of Content
Introduction
We express our gratitude to the Beldex team for the collaborative engagement that enabled the execution of this Pentest.
Beldex is a privacy-focused blockchain ecosystem built around the principle of “privacy in every online interaction.” Rather than a single application, Beldex operates a suite of privacy-preserving products spanning communications, networking, browsing, and finance, all underpinned by its own blockchain and native coin, BDX.
The Beldex network uses confidential transactions described as shielded, unlinkable, and untraceable and is secured and validated through a masternode architecture. BDX is the ecosystem's native utility token and serves as the medium of exchange between participants across Beldex products.
Document | |
|---|---|
| Name | Pentest and Security Analysis Report for Beldex |
| Approved By | Faizan Nehal |
| Website | beldex.dev |
| Changelog | 24/07/2026 - Preliminary Report |
| Platform | Web Application & API |
| Language | Node.js, React, Express |
| Tags | Pentest |
| Methodology | https://docs.hacken.io/methodologies/pentesting→ |
Document
- Name
- Pentest and Security Analysis Report for Beldex
- Approved By
- Faizan Nehal
- Website
- beldex.dev
- Changelog
- 24/07/2026 - Preliminary Report
- Platform
- Web Application & API
- Language
- Node.js, React, Express
- Tags
- Pentest
Review Scope | |
|---|---|
| Web Application | https://bridge.beldex.dev→ |
Review Scope
- Web Application
- https://bridge.beldex.dev→
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
{FindingsVulnSeverityStatusTable}
System Overview
The Beldex Bridge (bridge.beldex.dev) is a custodial cross-chain application that moves value between the Beldex network (native BDX) and Ethereum Sepolia (wrapped BBDX ERC-20). It supports two directions: BDX → BBDX (deposit BDX on Beldex → mint BBDX on Sepolia) and BBDX → BDX (burn BBDX on Sepolia → pay out BDX on Beldex).
The platform is split across two tiers, both fronted by Cloudflare (WAF + Managed Challenge):
\- Frontend a React/Vite single-page application serving the swap UI and wallet connection. \- API backend a separate Node/Express service (/api/v1/*) that orchestrates swaps, authenticates the write-path, and verifies on-chain deposit/burn events before releasing funds. It runs on a distinct, unlisted origin behind Cloudflare (kept separate from the static web origin 13.127.113.69, nginx on AWS ap-south-1).
Write access is gated by a signature-based session: the client requests a challenge, signs it with its wallet (personal_sign), and exchanges the signature for a bridge_proxy_session cookie. Core money endpoints are startSwap (creates a swap + deposit address), submitDeposit (submits the source-chain tx for verification), and getSwaps (status/polling). Crediting depends on the backend's asynchronous verifier confirming the source transaction on the relevant chain.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2026-1816 | Cross-User Deposit Theft in submitDeposit | fixed | Critical | |
| F-2026-1817 | Internal Infrastructure Exposed to the Internet | accepted | Medium | |
| F-2026-1816 | SIWE Message Lacks Domain/Chain Binding (Phishing Signature Replay + Session Takeover) | fixed | Medium | |
| F-2026-1816 | Missing Security Headers on Application Responses | fixed | Medium | |
| F-2026-1816 | Production Domain Serves a Development Build of the Frontend | fixed | Medium | |
| F-2026-1815 | Origin IP Exposure Enables Full Cloudflare/WAF Bypass | fixed | Medium | |
| F-2026-1817 | Shallow confirmation depth on both bridge legs reorg double-spend risk | fixed | Low | |
| F-2026-1817 | Backend accepts frontend-disabled chains (binanceChain, baseChain) with divergent / possibly fail-open validation | fixed | Low | |
| F-2026-1816 | Log Injection via /api/v1/log | fixed | Low | |
| F-2026-1816 | Session Cookie bridgeproxysession Missing Secure Flag | fixed | Low |
Appendix 1. Severity Definitions
Findings are categorized based on their potential impact and assigned a severity level using the Common Vulnerability Scoring System (CVSS) version 4.0: →
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following:
Scope Details | |
|---|---|
| Web Application | https://bridge.beldex.dev→ |
| Whitepaper | https://hackenio.cc/hacken-methodologies→ |
Scope Details
- Web Application
- https://bridge.beldex.dev→
Assets in Scope
Appendix 3. Additional Valuables
Frameworks and Methodologies
This security assessment was conducted in alignment with recognised penetration testing standards, methodologies and guidelines, including the NIST SP 800-115 – Technical Guide to Information Security Testing and Assessment →, the Penetration Testing Execution Standard (PTES) →, and the OWASP Testing Guide →. These assets provide a structured foundation for planning, executing, and documenting technical evaluations such as vulnerability assessments, exploitation activities, and security code reviews. Hacken’s internal penetration testing methodology extends these principles to Web2 and Web3 environments to ensure consistency, repeatability, and verifiable outcomes.