- Hacken
- Audits
- cube-exchange
- [PT] Cube Exchange | Web+API | Jan2025
Audit name:
[PT] Cube Exchange | Web+API | Jan2025
Date:
Mar 10, 2025
Table of Content
Introduction
We express our gratitude to the Cube Exchange team for the collaborative engagement that enabled the execution of this Pentest.
Cube.Exchange is an innovative cryptocurrency trading platform that leverages advanced multi-party computation (MPC) technology to ensure users retain full custody and control of their digital assets. Unlike traditional exchanges, Cube.Exchange allows users to trade directly from their MPC Vaults, eliminating the need to transfer assets into exchange custody.
Document | |
|---|---|
| Name | Pentest and Security Analysis Report for Cube Exchange |
| Audited By | Adedolapo Olayinka-Adeyemi |
| Approved By | Stephen Ajayi |
| Website | https://www.cube.exchange/→ |
| Changelog | 07/02/2025 - Preliminary Report |
| Changelog | 10/03/2025 - Final Report |
| Platform | Web_API |
| Tags | Pentest, GrayBox |
| Methodology | https://hackenio.cc/pentest_methodology→ |
Document
- Name
- Pentest and Security Analysis Report for Cube Exchange
- Audited By
- Adedolapo Olayinka-Adeyemi
- Approved By
- Stephen Ajayi
- Website
- https://www.cube.exchange/→
- Changelog
- 07/02/2025 - Preliminary Report
- Changelog
- 10/03/2025 - Final Report
- Platform
- Web_API
- Tags
- Pentest, GrayBox
- Methodology
- https://hackenio.cc/pentest_methodology→
Review Scope | |
|---|---|
| Repository | https://www.cube.exchange/→ |
| API Documentation | https://cubexch.gitbook.io/cube-api→ |
Review Scope
- Repository
- https://www.cube.exchange/→
- API Documentation
- https://cubexch.gitbook.io/cube-api→
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
System Overview
Cube.Exchange is a next-generation cryptocurrency trading platform powered by advanced multi-party computation (MPC) technology, ensuring users retain full custody of their assets. Unlike traditional exchanges, it enables direct trading from MPC Vaults, eliminating the need to transfer funds into exchange custody.
Key Features
Non-Custodial MPC Trading – Trade directly from your MPC Vault while maintaining full control of your assets.
Real-Time Trading – Execute trades instantly, track live prices, and manage orders seamlessly.
Comprehensive Portfolio Management – Monitor balances, analyze transaction history, and track performance.
CubeNet Settlement Layer – Instant trade reflections with secure final settlement on CubeNet, a meta-L2 blockchain.
Advanced Security – MPC encryption, distributed key generation, and KYC verification ensure robust security.
User-Friendly Interface – Intuitive design with real-time notifications for trades, market updates, and account activity.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2025-8448 | Origin IP for Production-like Environment | accepted | Low | |
| F-2025-8687 | Lack of User Input Sanitization in Subaccount and Addressbook Creation | fixed | Low | |
| F-2025-8498 | Lack of Session Timeout Mechanism | accepted | Observation | |
| F-2025-8449 | SSL Certificate Is About To Expire | accepted | Observation |
Appendix 1. Severity Definitions
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following:
Scope Details | |
|---|---|
| URL | https://www.cube.exchange/→ |
| API Documentation | https://cubexch.gitbook.io/cube-api→ |
Scope Details
- API Documentation
- https://cubexch.gitbook.io/cube-api→