Audit name:
[PT] CoinEx | Android | Mar2025
Date:
Mar 25, 2025
Table of Content
Introduction
We express our gratitude to the CoinEx team for the collaborative engagement that enabled the execution of this Pentest.
CoinEx is a global and professional digital coin exchange service provider, founded in December 2017. Operating as a sub-brand of ViaBTC (Viabtc Technology Limited), CoinEx is dedicated to building a highly secure, stable, and efficient digital coin exchange for global users
Document | |
|---|---|
| Name | Pentest and Security Analysis Report for CoinEx |
| Audited By | Sam Ronald |
| Approved By | Stephen Ajayi |
| Website | https://www.coinex.com/→ |
| Changelog | 17/03/2025 - Preliminary Report |
| Changelog | 25/03/2025 - Final Report |
| Platform | Android |
| Language | Java |
| Tags | Pentest |
| Methodology | https://hackenio.cc/pentest_methodology→ |
Document
- Name
- Pentest and Security Analysis Report for CoinEx
- Audited By
- Sam Ronald
- Approved By
- Stephen Ajayi
- Website
- https://www.coinex.com/→
- Changelog
- 17/03/2025 - Preliminary Report
- Changelog
- 25/03/2025 - Final Report
- Platform
- Android
- Language
- Java
- Tags
- Pentest
- Methodology
- https://hackenio.cc/pentest_methodology→
Review Scope | |
|---|---|
| Android | https://play.google.com/store/apps/details?id=com.coinex.trade.play&hl=en→ |
| Version | 3.43.2 |
Review Scope
- Version
- 3.43.2
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
System Overview
The CoinEx Android application offers a comprehensive platform for cryptocurrency trading, enabling users to manage their digital assets seamlessly on mobile devices.
Key Features:
Extensive Cryptocurrency Support: Users can trade a vast selection of cryptocurrencies, including popular options like BTC, ETH, DOGE, LTC, and XRP, directly through the mobile app. coinex.com →
Diverse Trading Options: The app facilitates various trading methods, such as spot trading, margin trading, and futures trading, allowing users to tailor their strategies to market conditions. support.coinex.com →
User-Friendly Interface: Designed for both novice and experienced traders, the app features an intuitive interface that simplifies navigation and enhances the trading experience.
Real-Time Market Data: Users have access to timely market feeds and in-depth market analysis, empowering them to make informed trading decisions. coinex.com+1coinex.com+1 →
Security Measures: The application incorporates robust security protocols to protect user assets and personal information, aligning with CoinEx's commitment to a secure trading environment.
Futures Demo Trading: To assist users in mastering futures trading without financial risk, the app offers a demo trading feature that simulates real market conditions.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2025-9168 | Insecure Cleartext Traffic Usage | fixed | Low | |
| F-2025-9134 | SSL Pinning Bypass | accepted | Low | |
| F-2025-9165 | Predictable Pseudorandom Number Generator (PRNG) | accepted | Observation |
Appendix 1. Severity Definitions
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following:
Scope Details | |
|---|---|
| Android | https://play.google.com/store/apps/details?id=com.coinex.trade.play&hl=en→ |
| Version | 3.43.2 |
Scope Details
- Version
- 3.43.2