Audit name:
[PT] Bit2Me | Web_API | Jan2024
Date:
Feb 22, 2024
Table of Content
Introduction
We express our gratitude to the Bit2me team for the collaborative engagement that enabled the execution of this Security Assessment.
Bit2me is a cryptocurrency trading platform that offers trading in over 240 cryptocurrencies.
| title | content |
|---|---|
| Timeline | 03/01/2024 - 23/01/2024 |
| Methodology | https://hackenio.cc/dApp_methodology→ |
Review Scope | |
|---|---|
| Web Application | www.bit2me.com |
| API Documentation | https://api.bit2me.com→ |
Review Scope
- Web Application
- www.bit2me.com
- API Documentation
- https://api.bit2me.com→
Audit Summary
10/10
\-
\-
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | We Application Penetration Test Report for Bit2me |
| Audited By | Stephen Ajayi |
| Approved By | Stephen Ajayi |
| Website | https://bit2me.com→ |
| Changelog | 12/02/2024 - Retest Repor |
Document
- Name
- We Application Penetration Test Report for Bit2me
- Audited By
- Stephen Ajayi
- Approved By
- Stephen Ajayi
- Website
- https://bit2me.com→
- Changelog
- 12/02/2024 - Retest Repor
System Overview
Bit2Me is recognized as the world's safest, easiest, and most comprehensive cryptocurrency trading platform, catering to a wide range of users including individuals, companies, and institutions. With an expansive offering of more than 240 cryptocurrencies, Bit2Me provides a versatile and extensive platform for trading and investing in a diverse array of digital assets. One of the standout features of Bit2Me is its commitment to exceptional customer service, which is regarded as the best in the industry.
The Scope of the penetration test include:
Executive Summary
Security score
Upon initial auditing, the code was found to contain 0 critical, 2 high, 1 medium, and 0 low severity issues, leading to a security score of 5 out of 10. After retesting, we confirmed that the issues identified in the initial penetration test have been successfully resolved, achieving a perfect security score of 10 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's web application yields an overall score of 10. The risk score is based on a detailed review of the environment and identified vulnerabilities, focusing on how easily they can be exploited and their potential effects. Given these considerations, your organization's risk level is classified as Low. This assessment is mainly due to the successful remediation of the vulnerabilities we initially found.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2024-0535 | Insecure Transmission of Credentials via Basic Authentication | fixed | High | |
| F-2024-0530 | Cross-Origin Resource Sharing (CORS) Misconfiguration | fixed | High | |
| F-2024-0536 | Missing Important Security Headers | fixed | Medium | |
| F-2024-0542 | Swagger Backend API Endpoint Exposure | unfixed | Observation | |
| F-2024-0541 | Impending TLS/SSL Certificate Expiry | unfixed | Observation |
Appendix 1. Severity Definitions
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following :
Scope Details | |
|---|---|
| Web Applications | http://account.bit2me.com→ |
| API | http://api.bit2me.com→ |
| Whitepaper | Not Required |
| Requirements | Not Required |
| Technical Requirements | Not Required |
Scope Details
- Web Applications
- http://account.bit2me.com→
- Whitepaper
- Not Required
- Requirements
- Not Required
- Technical Requirements
- Not Required