TRUST Summit | Nov 3, 2025 | NYCWhere decision-makers define the next chapter of secure blockchain adoption.
Learn more

Petra Vault

Audit name:

[dApp] Petra Vault | MultiSig | May2025

Date:

Jul 14, 2025

Table of Content

→Introduction
→Audit Summary
→System Overview
→Findings
→Appendix 1. Severity Definitions
→Appendix 2. Scope
→Disclaimer

Want a comprehensive audit report like this?

Introduction

We express our gratitude to the Petra Vault team for the collaborative engagement that enabled the execution of this dApp Security Assessment.

Petra Vault is a decentralized custody solution built on the Aptos blockchain. Theyprovides a secure, multi‑party computation (MPC) based multisig wallet for enterprise and advanced individual users.

Document

NamedApp Code Review and Security Analysis Report for Petra Vault
Audited ByStephen Ajayi
Approved ByStephen Ajayi
Websitehttps://vault.petra.app/→
Changelog16/06/2025 - Preliminary Report
Changelog14/07/2025 - Final Report
PlatformPetra, Aptos
LanguageTypeScript
TagsCode Review
Methodologyhttps://hackenio.cc/dApp_methodology→

  • Document

    Name
    dApp Code Review and Security Analysis Report for Petra Vault
    Audited By
    Stephen Ajayi
    Approved By
    Stephen Ajayi
    Website
    https://vault.petra.app/→
    Changelog
    16/06/2025 - Preliminary Report
    Changelog
    14/07/2025 - Final Report
    Platform
    Petra, Aptos
    Language
    TypeScript
    Tags
    Code Review
    Methodology
    https://hackenio.cc/dApp_methodology→

Review Scope

Repositoryhttps://github.com/aptos-labs/petra-vault→
Initial Commit3f9d0fceb25eb60ab35760f83ff8842b99909905
Final Commit7676db426364c6acdb1a15777b13b4cd51225a5c

Audit Summary

12Total Findings
7Resolved
4Accepted
1Mitigated

The system users should acknowledge all the risks summed up in the risks section of the report

Documentation quality

  • The repository includes a high-level README.md that covers installation, setup, and basic usage of the Petra Vault application. However:

  • Clear getting-started instructions for developers (prerequisites, installation commands, environment variables).

  • Links to key external resources (Aptos documentation, Petra Vault guides).

  • Monorepo structure is summarized with folder descriptions.

Code quality

  • Maintainability Issues: Widespread nested ternary expressions leading to cognitive complexity (multiple files, critical in proposal creation flow); repeated ESLint/Sonar complaints (unnecessary assertions, multiple imports of the same module, and unused variables); lack of readonly typings for React props (risk of unintended mutation).

  • Consistency: Frequent use of || instead of the safer ?? operator across many components; inconsistent key usage in React lists (use of array indices).

  • Reliability & Accessibility: Missing lang prop on <html> and missing title on iframes; non‑interactive elements attached to click handlers without keyboard listeners.

  • Performance: Inline component definitions causing re‑renders; array index‑based key props in lists.

System Overview

Petra Vault is a web-based custody solution built on the Aptos blockchain, offering a threshold-based, MPC multisig wallet. Through an intuitive Next.js interface and robust Move modules, Petra Vault enables users to:

  • Create or import vaults with configurable signing policies.

  • Draft and simulate multisig transactions before submission.

  • Collect approvals from multiple signers in accordance with defined thresholds.

  • Execute on-chain transactions securely and transparently.

The platform targets enterprise and power-users who require enhanced security guarantees and collaborative fund management.

Project Overview

  • Frontend (apps/web)

    • Next.js App Router separates public marketing pages from authenticated vault workflows.

    • Contexts (ActiveVaultProvider, OnboardingProvider) manage vault state and user roles.

    • Key flows: Onboarding, Dashboard, Proposal creation/simulation, and Transaction history.

  • Wallet API (**packages/wallet-api/src**)

    • Lightweight TypeScript client for Aptos interactions:

    • Error handling (errors/)

    • BCS/json serialization (serialization/)

    • Connection & account management

    • Transaction signing & submission

    • Signature aggregation & approval orchestration (signatures/, types/)

Findings

Code
―
Title
Status
Severity
F-2025-1089GraphQL Deep-Introspection & Query Depth Abuse
accepted

High
F-2025-1071Missing window.postMessage Origin Check Might lead to Arbitrary RPC/Signing Abuse
fixed

High
F-2025-1071Unrestricted Iframe “url” Parameter → XSS, Open Redirect & Clickjacking Risk
mitigated

High
F-2025-1073Insufficient Origin Validation in handleRequest
fixed

High
F-2025-1089GraphQL Alias Flooding Amplification Attack
accepted

Medium
F-2025-1089GraphQL Batch Amplification Attack
accepted

Medium
F-2025-1089Improper CORS Configuration – Dynamic Origin Reflection with Credentials
fixed

Medium
F-2025-1089GraphQL Introspection Enabled in Production
accepted

Low
F-2025-1078Unsanitized Vault Name Display
fixed

Low
F-2025-1077Missing JSON validations Enables Denial-of-Service
fixed

Low
1-10 of 12 findings

Protect your dApp with insights like these.

Appendix 1. Severity Definitions

Severity

Description

Critical
These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.

High
These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.

Medium
These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.

Low
These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.

  • Severity

    Critical

    Description

    These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.

    Severity

    High

    Description

    These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.

    Severity

    Medium

    Description

    These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.

    Severity

    Low

    Description

    These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.

Appendix 2. Scope

The scope of the project includes the following:

Scope Details

Repositoryhttps://github.com/aptos-labs/petra-vault→
Initial Commit3f9d0fceb25eb60ab35760f83ff8842b99909905
Final Commit7676db426364c6acdb1a15777b13b4cd51225a5c

Assets in Scope

Petra Vault - Petra Vault

Disclaimer