Audit name:
[PT] Europeum | API | Aug2026
Date:
Sep 9, 2026
Table of Content
Introduction
We express our gratitude to the Europeum team for the collaborative engagement that enabled the execution of this dApp Security Assessment.
Document | |
|---|---|
| Name | dApp Code Review and Security Analysis Report for Europeum |
| Audited By | Abdelfattah Ibrahim |
| Approved By | Bogdan Bodisteanu |
| Website | https://europeum.eu/→ |
| Changelog | 28/08/2026 - Preliminary Report |
| 08/09/2026 - Final Report | |
| Language | Typescript |
| Tags | Pentest (White-box) |
| Methodology | https://docs.hacken.io/methodologies/dapp-audit-methodology→ |
Document
- Name
- dApp Code Review and Security Analysis Report for Europeum
- Audited By
- Abdelfattah Ibrahim
- Approved By
- Bogdan Bodisteanu
- Website
- https://europeum.eu/→
- Changelog
- 28/08/2026 - Preliminary Report
- 08/09/2026 - Final Report
- Language
- Typescript
- Tags
- Pentest (White-box)
Review Scope | |
|---|---|
| Repository | https://gitlab.com/europeum/public/core-services/→ |
| Commit | 85e8e1d3b92258f25e8f1207617c75d32fca5555 |
| Final Commit | 60a26443bde7f9487239aaa73d52f555fd871c30 |
Review Scope
- Commit
- 85e8e1d3b92258f25e8f1207617c75d32fca5555
- Final Commit
- 60a26443bde7f9487239aaa73d52f555fd871c30
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
{FindingsVulnSeverityStatusTable}
System Overview
The Europeum/EBSI Core Services API is a NestJS and TypeScript gateway that connects clients to blockchain-based identity and trust services running on Hyperledger Besu. It provides public read access to DID records, trusted issuers and accreditations, policies, credential schemas, registered contracts, timestamps, and Track and Trace documents, events, and permissions. For protected operations, its OpenID-style authorization service validates verifiable presentations and credentials, issues scoped JWT access tokens, and authorizes signed blockchain transactions before the Ledger JSON-RPC proxy forwards them to Besu. The API also exposes issuer status-list proxying, smart-contract ABIs, OpenAPI specifications, health monitoring, contract templates, hash-algorithm information, and registry history and revision data.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2026-1899 | DID Registry invite tokens can be minted without holder proof and used to seize the subject DID | fixed | Critical | |
| F-2026-1899 | Unverified registry accreditation bodies let a trusted issuer self-escalate to root authority | fixed | High | |
| F-2026-1907 | TSR schema updates have no ownership binding | fixed | High | |
| F-2026-1906 | Timestamp record-version metadata is unbounded, causing unauthenticated RPC fanout | fixed | High | |
| F-2026-1904 | Anonymous unregistered parties authenticate and can register arbitrary DIDs | fixed | High | |
| F-2026-1906 | Timestamp lookup returns unverified transaction provenance | fixed | Medium | |
| F-2026-1906 | Onboarding accreditation is always validated against the default trust stack, not the targeted instance | fixed | Medium | |
| F-2026-1905 | Address-qualified scope is parsed but never enforced at transaction submission | fixed | Medium | |
| F-2026-1905 | proxyRequest SSRF surface via redirect and DNS rebinding | fixed | Medium | |
| F-2026-1904 | SSRF in the issuer-proxy write validator | fixed | Medium |
Appendix 1. Severity Definitions
Findings are categorized based on their potential impact and assigned a severity level using the Common Vulnerability Scoring System (CVSS) version 4.0: →
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following:
Scope Details | |
|---|---|
| Repository | https://gitlab.com/europeum/public/core-services/→ |
| Commit | 85e8e1d3b92258f25e8f1207617c75d32fca5555 |
| Final Commit | 60a26443bde7f9487239aaa73d52f555fd871c30 |
Scope Details
- Commit
- 85e8e1d3b92258f25e8f1207617c75d32fca5555
- Final Commit
- 60a26443bde7f9487239aaa73d52f555fd871c30
Assets in Scope
Appendix 3. Additional Valuables
Frameworks and Methodologies
This security assessment was conducted in alignment with recognised penetration testing standards, methodologies and guidelines, including the NIST SP 800-115 – Technical Guide to Information Security Testing and Assessment →, the Penetration Testing Execution Standard (PTES) →, and the OWASP Testing Guide →. These assets provide a structured foundation for planning, executing, and documenting technical evaluations such as vulnerability assessments, exploitation activities, and security code reviews. Hacken’s internal penetration testing methodology extends these principles to Web2 and Web3 environments to ensure consistency, repeatability, and verifiable outcomes.