Audit name:
[PT] CoinEx / Web+API / Mar2025
Date:
Apr 22, 2025
Table of Content
Introduction
We express our gratitude to the CoinEx team for the collaborative engagement that enabled the execution of this Pentest.
CoinEx is a Centralized Exchange allowing users to deposit, trade, withdraw cryptocurrencies as well as use other features related to cryptocurrency trading.
Document | |
|---|---|
| Name | Pentest and Security Analysis Report for CoinEx |
| Audited By | Lukasz Mikula |
| Approved By | Stephen Ajayi |
| Website | https://www.coinex.com/→ |
| Changelog | 24/03/2025 - Preliminary Report |
| Platform | Web |
| Language | Node.js, MySQL, Redis |
| Tags | BlackBox |
| Methodology | https://hackenio.cc/pentest_methodology→ |
Document
- Name
- Pentest and Security Analysis Report for CoinEx
- Audited By
- Lukasz Mikula
- Approved By
- Stephen Ajayi
- Website
- https://www.coinex.com/→
- Changelog
- 24/03/2025 - Preliminary Report
- Platform
- Web
- Language
- Node.js, MySQL, Redis
- Tags
- BlackBox
- Methodology
- https://hackenio.cc/pentest_methodology→
Review Scope | |
|---|---|
| URL | https://www.coinex.com/en/→ |
Review Scope
Protect your dApp with insights like these.
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
Threat Model Overview
This model outlines some key attack scenarios and security risks assessed during both manual and automated penetration testing of Gunzilla API.
Manual Testing Highlights
Broken Access Control: Scenario: Manipulating user/account IDs in API requests to access or alter unauthorized data, potentially facilitating fund transfers.
Authentication Issues: Scenario: Weak password policies, lack of multi-factor authentication, and reliance on outdated authentication libraries.
Sensitive Information Disclosure: Scenario: API responses exposing private keys, wallet addresses, or KYC details.
Rate Limiting Weaknesses: Scenario: Inadequate rate limiting enabling brute-force or denial-of-service (DoS) attacks, such as excessive OTP requests.
Security Misconfigurations: Scenario: Exposed admin panels, use of default credentials, and verbose error messages revealing system details.
Injection Attacks: Scenario: Unsanitized inputs allowing SQL/NoSQL injections or remote code execution.
XSS & CSRF Vulnerabilities: Scenario: Injection of malicious scripts or forged requests leading to session hijacking and unauthorized actions.
Race-Condition Exploits: Scenario: Exploiting timing flaws to manipulate transaction processes, such as double-spending.
Automated Testing Highlights
Directory & File Enumeration: Scenario: Using tools like Dirsearch and FFuF to uncover exposed directories and sensitive configuration files.
API Security Testing: Scenario: Automated scans (via Burp Suite) revealing broken access controls and insufficient rate limiting.
Web Application Scanning: Scenario: Security scanners (e.g., Nessus, Nikto) detecting SQL injection, XSS, and misconfigurations.
Security Header & Port Analysis: Scenario: Nmap scans indicating missing security headers (e.g., X-Frame-Options, HSTS) that could expose the application to clickjacking attacks.
Injection Testing: Scenario: Tools like SQLmap identifying injection vulnerabilities in various endpoints.
Conclusion
The web application exhibited solid security posture, and the authorization matrix was implemented correctly.
System Overview
CoinEx is a centralized cryptocurrency exchange allowing users to deposit, trade, withdraw their cryptocurrencies as well as participate in various types of other activities related to Web3 community.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2025-9296 | Weak password policy | accepted | Low | |
| F-2025-9299 | Potentially accessible development environment | accepted | Observation | |
| F-2025-9298 | Verbose error messages | fixed | Observation | |
| F-2025-9297 | API key exposure | accepted | Observation |
Uncover findings like these to secure your project.
Appendix 1. Severity Definitions
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following URL:
Scope Details | |
|---|---|
| URL | https://coinex.com→ |
Scope Details