Q2 2026 Security & Compliance Report67 incidents, $764M in losses, 88% from operational failures.
Get the report →
Bitunix logo

Bitunix

Audit name:

[PT] Bitunix | Android | Apr2025

Date:

Jun 5, 2025

Table of Content

→Introduction
→Audit Summary
→System Overview
→Findings
→Appendix 1. Severity Definitions
→Appendix 2. Scope
→Disclaimer

Want a comprehensive audit report like this?

Introduction

We express our gratitude to the Bitunix team for the collaborative engagement that enabled the execution of this Pentest.

Bitunix is a cryptocurrency exchange platform that enables users to buy, sell, and trade various digital assets. The platform supports features such as spot trading, futures, staking, user referral bonuses, and KYC identity verification.

Document

NamePentest and Security Analysis Report for Bitunix
Audited ByStephen Ajayi
Approved ByStephen Ajayi
Websitehttps://bitunix.com→
Changelog08/05/2025 - Preliminary Report
Changelog03/06/2025 - Final Report
PlatformAndroid
LanguageJava, Kotlin
TagsPentest
Methodologyhttps://hackenio.cc/pentest_methodology→

Review Scope

Androidhttps://download.bitunix.com/bitunix.apk→
Version2025.0429.15398

Protect your dApp with insights like these.

Audit Summary

8Total Findings
6Resolved
2Accepted
0Mitigated

The system users should acknowledge all the risks summed up in the risks section of the report

System Overview

The Bitunix Android application is a mobile-first cryptocurrency trading platform designed to provide users with secure and efficient access to digital asset services. The application supports real-time trading, identity verification, asset management, and user engagement features within a modern mobile interface.

Key Features

  • User Authentication: Email and mobile-based registration and login mechanisms.

  • KYC Verification: Upload and submission of government-issued ID documents with approval tracking.

  • Trading Dashboard: Access to spot and futures trading pairs, order management, and live price tracking.

  • Wallet Management: Deposit, withdraw, and monitor digital asset balances.

  • Document Uploads: Multipart/form-data-based document handling through HTTP APIs.

  • User Campaigns and Promotions: Referral systems and bonus programs tied to account actions.

Findings

F-2025-1017Improper Authorization on KYC Document Upload (Post-Verification Bypass)
Status
fixed
Severity

High
F-2025-1017Exposure of Personally Identifiable Information (PII) via ID Lookup
Status
fixed
Severity

Medium
F-2025-1017Insecure SSL Pinning Implementation
Status
accepted
Severity

Medium
F-2025-1018Insecure File Provider Paths Configuration
Status
fixed
Severity

Low
F-2025-1018Insecure or Missing Android Network Security Configuration
Status
fixed
Severity

Low
F-2025-1017Use of Outdated APK Signature Schemes (v1/v2 Only)
Status
fixed
Severity

Low
F-2025-1017Sensitive Data Exposure via Clipboard in Password Field
Status
fixed
Severity

Low
F-2025-1017Absence of Root Detection Mechanisms
Status
accepted
Severity

Observation
Code
―
Title
Status
Severity
F-2025-1017Improper Authorization on KYC Document Upload (Post-Verification Bypass)
fixed

High
F-2025-1017Exposure of Personally Identifiable Information (PII) via ID Lookup
fixed

Medium
F-2025-1017Insecure SSL Pinning Implementation
accepted

Medium
F-2025-1018Insecure File Provider Paths Configuration
fixed

Low
F-2025-1018Insecure or Missing Android Network Security Configuration
fixed

Low
F-2025-1017Use of Outdated APK Signature Schemes (v1/v2 Only)
fixed

Low
F-2025-1017Sensitive Data Exposure via Clipboard in Password Field
fixed

Low
F-2025-1017Absence of Root Detection Mechanisms
accepted

Observation
1-8 of 8 findings

Uncover findings like these to secure your project.

Appendix 1. Severity Definitions

Severity

Description

Critical
These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.

High
These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.

Medium
These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.

Low
These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.

  • Severity

    Critical

    Description

    These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.

    Severity

    High

    Description

    These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.

    Severity

    Medium

    Description

    These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.

    Severity

    Low

    Description

    These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.

Appendix 2. Scope

The scope of the project includes the following:

Scope Details

Androidhttps://download.bitunix.com/bitunix.apk→
Version2025.0429.15398

Disclaimer