The Hacken 2025 Yearly Security ReportCovers major Web3 breaches, their root causes, prevention insights, and key regulatory trends for 2026.
Learn more

Orange Crypto

Audit name:

[PT] Orange Crypto | Web | Feb2024

Date:

Apr 12, 2024

Table of Content

→Introduction
→Audit Summary
→Document Information
→System Overview
→Executive Summary
→Findings
→Appendix 1. Severity Definitions
→Appendix 2. Scope

Want a comprehensive audit report like this?

Introduction

We express our gratitude to the Orange Crypto team for the collaborative engagement that enabled the execution of this Security Assessment.

Orange Wallet is a browser extension software wallet that simplifies managing Bitcoin, BRC20 tokens, Stacks, and Ordinals NFTs. It features integration with Orange Assistant and AI for instant access to crypto industry insights. Orange Wallet stands out for its user-friendly, decentralized, non-custodial, and anonymous nature, offering direct Bitcoin blockchain access without third-party involvement. Your private key remains exclusively yours, ensuring your Bitcoin is securely stored on the blockchain without collecting any personal data. Supporting a variety of protocols like BRC20, Ordinals, Stacks, and Bitcoin itself, Orange Wallet is your all-in-one solution for diverse crypto assets management.

titlecontent
PlatformCrypto Wallet
LanguageTypeScript
Timeline16/02/2024 - 22/03/2024
Methodologyhttps://hackenio.cc/dApp_methodology→

    Review Scope

    Repositoryhttps://github.com/orangecryptohq/orangewallet/tree/release/v1.0.4,→
    Commitn/a

    Protect your dApp with insights like these.

    Audit Summary

    19Total Findings
    16Resolved
    2Accepted
    0Mitigated

    The system users should acknowledge all the risks summed up in the risks section of the report

    Document Information

    This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.

    The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.

    Document

    NameDecentralized Application (dApp) Code Review and Security Analysis Report for Orange Crypto
    Audited ByStephen Ajayi
    Approved ByStephen Ajayi
    Websitehttps://hacken.io→
    Changelog25/02/2024 - Preliminary Report

    • Document

      Name
      Decentralized Application (dApp) Code Review and Security Analysis Report for Orange Crypto
      Audited By
      Stephen Ajayi
      Approved By
      Stephen Ajayi
      Website
      https://hacken.io→
      Changelog
      25/02/2024 - Preliminary Report

    System Overview

    Orange Wallet is a browser extension software wallet that simplifies managing Bitcoin, BRC20 tokens, Stacks, and Ordinals NFTs. It features integration with Orange Assistant and AI for instant access to crypto industry insights. Orange Wallet stands out for its user-friendly, decentralized, non-custodial, and anonymous nature, offering direct Bitcoin blockchain access without third-party involvement. Your private key remains exclusively yours, ensuring your Bitcoin is securely stored on the blockchain without collecting any personal data. Supporting a variety of protocols like BRC20, Ordinals, Stacks, and Bitcoin itself, Orange Wallet is your all-in-one solution for diverse crypto assets management.

    Asset:

    Executive Summary

    Documentation quality

    The total Documentation Quality score is 10 out of 10.

    • Comprehensive functional requirements were outlined.

    • Detailed technical specifications were provided.

    • Complete documentation for setting up, building the wallet, and integrating it with a browser was made available.

    Code quality

    The total Code Quality score is 10 out of 10.

    • The code has been structured with clarity and coherence.

    • The coding style maintained throughout is uniform.

    • The development environment has been properly configured.

    Security score

    Upon auditing, the code was found to contain 0 critical, 4 high, 5 medium, and 5 low severity issues, leading to a security score of 10 out of 10.

    All identified issues are detailed in the “Findings” section of this report.

    Summary

    The comprehensive audit of the customer's dapp yields an overall score of 10. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.

    Scoring Methodologyarrow right

    Findings

    Code
    ―
    Title
    Status
    Severity
    F-2024-1036Plaintext User Password Exposure in Memory
    fixed

    High
    F-2024-1035Plaintext Secret Keyphrase Exposure in Memory
    fixed

    High
    F-2024-0871Insecure Random Number Generation
    fixed

    High
    F-2024-0862Use of Password Hash Directly as Key
    fixed

    High
    F-2024-0951Potential Mismanagement of Sensitive Information
    fixed

    Medium
    F-2024-0876Insecure Default Configuration (CORS)
    fixed

    Medium
    F-2024-0874Overly Broad Host Permissions
    fixed

    Medium
    F-2024-0847Insecure Deserialization
    fixed

    Medium
    F-2024-0822Open Redirect Vulnerability in Wallet Redirection Logic
    fixed

    Medium
    F-2024-1033Sensitive Data Exposure through Clipboard
    accepted

    Low
    1-10 of 19 findings

    Uncover findings like these to secure your project.

    Appendix 1. Severity Definitions

    Severity

    Description

    Critical
    		These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.

    High
    		These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.

    Medium
    		These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.

    Low
    		These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.

    • Severity

      Critical

      Description

      These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.

      Severity

      High

      Description

      These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.

      Severity

      Medium

      Description

      These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.

      Severity

      Low

      Description

      These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.

    Appendix 2. Scope

    The scope of the project includes the following endpoints from the provided repository:

    Assets in Scope

    Wallet Source Code - Wallet Source Code
    Wallet Extension - Wallet Extension
    Orange Crypto audit by Hacken