- Hacken
- Audits
- thg-assetguard
- [PT] THG AssetGuard Wallet | API Pentest | Aug2025
Audit name:
[PT] THG AssetGuard Wallet | API Pentest | Aug2025
Date:
Oct 3, 2025
Table of Content
→Introduction
→Audit Summary
→System Overview
→Findings
→Appendix 1. Severity Definitions
→Appendix 2. Scope
→Disclaimer
Introduction
We express our gratitude to the THG AssetGuard Wallet team for the collaborative engagement that enabled the execution of this dApp Security Assessment.
THG AssetGuard Wallet is a secure, user-friendly cryptocurrency wallet designed specifically for the Hedera network.
Document | |
|---|---|
| Name | API Penetration Testing Report for THG AssetGuard |
| Audited By | |
| Approved By | |
| Changelog | 25/08/2025 |
| Platform | API |
| Tags | dApp, API |
| Methodology | https://hackenio.cc/dApp_methodology→ |
Document
- Name
- API Penetration Testing Report for THG AssetGuard
- Audited By
- Approved By
- Changelog
- 25/08/2025
- Platform
- API
- Tags
- dApp, API
- Methodology
- https://hackenio.cc/dApp_methodology→
Review Scope | |
|---|---|
| API | https://ew-wallet-backend.pub.prd.hashgraph-group.com→ |
Review Scope
Audit Summary
5Total Findings
5Resolved
0Accepted
0Mitigated
The system users should acknowledge all the risks summed up in the risks section of the report
System Overview
THG Wallet is a secure, user-friendly cryptocurrency wallet designed specifically for the Hedera network.
It allows seamless management of your HBAR, tokens, and NFTs.
Findings
F-2025-1236Open unencrypted HTTP port 15021
Status
fixed
Severity
Low
F-2025-1236Improper handling of frequent requests leads to 429 Too Many Requests escalating into 500 Internal Server Error with debug disclosure
Status
fixed
Severity
Low
F-2025-1235Improper request path handling with ; leads to 500 Internal Server Error and debug information disclosure
Status
fixed
Severity
Low
F-2025-1235Improper domain handling in Origin header leading to 500 Internal Server Error
Status
fixed
Severity
Low
F-2025-1236Missing Security Headers
Status
fixed
Severity
Observation
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2025-1236 | Open unencrypted HTTP port 15021 | fixed | Low | |
| F-2025-1236 | Improper handling of frequent requests leads to 429 Too Many Requests escalating into 500 Internal Server Error with debug disclosure | fixed | Low | |
| F-2025-1235 | Improper request path handling with ; leads to 500 Internal Server Error and debug information disclosure | fixed | Low | |
| F-2025-1235 | Improper domain handling in Origin header leading to 500 Internal Server Error | fixed | Low | |
| F-2025-1236 | Missing Security Headers | fixed | Observation |
1-5 of 5 findings
Appendix 1. Severity Definitions
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes endpoints from the provided repository (api.yml):
Scope Details | |
|---|---|
| API | https://ew-wallet-backend.pub.prd.hashgraph-group.com/→ |
| Whitepaper | https://hackenio.cc/hacken-methodologies→ |
Scope Details
Assets in Scope
ew-wallet-backend.pub.prd.hashgraph-group.com - ew-wallet-backend.pub.prd.hashgraph-group.com