Collafi

We express our gratitude to the Collafi team for the collaborative engagement that enabled the execution of this dApp Security Assessment.

Backend API for CollaFi, a peer-to-peer NFT-collateralized lending platform on Hedera. Lenders fund HBAR loan offers against NFT collections; borrowers escrow NFTs as collateral and repay with interest, with operator controlled on chain settlement for payouts, liquidations, and collateral claims

The system users should acknowledge all the risks summed up in the risks section of the report

{FindingsVulnSeverityStatusTable}

Documentation quality

• Technical description is not provided.

Code quality

• Validation applied inconsistently - same data checked in one route, unchecked in another.

• No atomic state transitions or idempotency - guards exist in places, but aren't used systematically.

• Clean modular structure and centralized config.

Test coverage

Code coverage of the project is 0% The repository contains no test suite, test framework, or test script.

• Core lending flows (offer, accept, repay, claim) are not covered with tests.

• Negative cases coverage is missed.

• Interactions by several users are not tested.

CollaFi Server is the backend of a peer-to-peer NFT-collateralized lending protocol on Hedera, exposing a REST API with the following components:

• Lending Core - the money moving heart of the system. Lenders create HBAR loan offers against NFT collections; funds move from the lender to the platform operator account on chain at creation.

• Operator - the platform's custodial Hedera account that holds all escrowed HBAR and NFTs. Supports primary/backup failover with on-demand asset migration between operator accounts.

• Collections - per NFT collection lending terms: loan duration days, lender/borrower fee bps, repay interest bps, treasury interest share, and interest discounts based on NFT holdings. Admin-managed, but created implicitly on first offer.

• Auth - passwordless login via Hedera wallet signature (challenge/response), issuing HS256 JWTs with 1-hour expiry. Admin authorization is a boolean claim granted at login against a wallet whitelist. Includes email verification and X account linking via OAuth 2.0 with PKCE.

• Rewards & Quests - a points ledger crediting per-HBAR rates for lending actions (offer create, accept, repay, claim) and fixed points for quests (X follow/like/repost/reply, email verification). Points are spent in an NFT reward shop fulfilled from the rewards wallet. Includes public leaderboards.

• Marketplace Proxies - server-side relays for Sentx and Kabila floor-price data using the platform's API keys.

• Admin - settings, collection CRUD, blacklist management, points adjustment, and a danger-zone operator promotion endpoint.

It has the following attributes:

• Stack: Node.js, Express, Prisma ORM, PostgreSQL

• Chain: Hedera — HBAR and HTS NFTs; mirror node for reads, SDK for writes

• Auth: wallet-signature challenge JWT

• Custody: all user funds/collateral held by the operator account

• External services: X API (OAuth 2.0).

The scope of the project includes the following endpoints from the provided repository:

Public:

• GET /activity/public

• POST /auth/challenge

• POST /admin/auth/challenge

• POST /auth/verify

• POST /admin/auth/verify

• GET /collections

• GET /stats/public

• GET /leaderboard/lending

• GET /leaderboard/collections

• GET /marketplace/kabila-floor

• GET /marketplace/sentx-floor

• GET /offers/collection

• GET /quests/x/callback

• GET /rewards/public

• GET /settings/public

• ALL /api/uploadthing

Authenticated:

• POST /auth/profile

• POST /auth/profile-image

• GET /auth/me

• POST /auth/verify-email-code

• GET /loans/association-status

• POST /loans

• GET /loans/accepted

• GET /loans/lender

• POST /loans/:id/repay

• POST /loans/repay-bulk

• POST /loans/:id/claim

• POST /loans/claim-bulk

• GET /notifications

• POST /notifications/read-all

• GET /offers

• GET /offers/interest-split

• POST /offers/accept

• DELETE /offers/:id

• POST /offers/rescind-bulk

• GET /quests/me

• POST /quests/email

• POST /quests/x/start

• POST /quests/x/verify-like

• POST /quests/x/verify-repost

• POST /quests/x/verify-reply

• POST /quests/x/verify-follow

• POST /quests/complete-all

• GET /rewards/me

• GET /rewards

• GET /rewards/history

• POST /rewards/:id/claim

Admin:

• GET /admin/activity

• GET /admin/analytics

• GET /admin/blacklist

• POST /admin/blacklist

• DELETE /admin/blacklist/:id

• GET /admin/collections

• POST /admin/collections

• PUT /admin/collections/order

• PUT /admin/collections/:id

• DELETE /admin/collections/:id

• GET /admin/danger/operator-status

• POST /admin/danger/promote-backup

• GET /admin/rewards/rules

• PUT /admin/rewards/rules

• GET /admin/rewards/inventory

• GET /admin/rewards/accounts

• POST /admin/rewards/accounts/adjust

• POST /admin/rewards/associate

• PUT /admin/rewards/items/:id

• POST /admin/rewards/items/:id/extract

• GET /admin/rewards/ledger

• GET /admin/settings

• PUT /admin/settings

• GET /admin/subcategories

• POST /admin/subcategories

Internal (worker key):

• POST /internal/loans/:id/default

• POST /internal/loans/:id/reminder

Assets in Scope