Q2 2026 Security & Compliance Report67 incidents, $764M in losses, 88% from operational failures.
Get the report →
THG AssetGuard logo

THG AssetGuard

Audit name:

[PT] THG AssetGuard Wallet | iOS App Pentest | Aug2025

Date:

Oct 3, 2025

Table of Content

→Introduction
→Audit Summary
→System Overview
→Findings
→Appendix 1. Severity Definitions
→Appendix 2. Scope
→Disclaimer

Want a comprehensive audit report like this?

Introduction

We express our gratitude to the THG AssetGuard Wallet team for the collaborative engagement that enabled the execution of this Pentest.

THG AssetGuard Wallet is a user first, Hedera native, non custodial wallet that streamlines web3 onboarding and dApp interactions letting users create accounts quickly, manage HBAR plus Hedera tokens and NFTs, and connect to Hedera apps, all while hiding network level complexity from users.

Document

NamePentest and Security Analysis Report for THG AssetGuard
Audited By
Approved By
Websitehttps://www.hashgraph-group.com/products/assetguard→
Changelog26/08/2025 - Preliminary Report
PlatformiOS
LanguageSwift
TagsMobile Application Pentest
Methodologyhttps://hackenio.cc/pentest_methodology→

Review Scope

Testflighthttps://testflight.apple.com/join/FRn8YM7w→
Version1.0.3.13

Protect your dApp with insights like these.

Audit Summary

3Total Findings
2Resolved
1Accepted
0Mitigated

The system users should acknowledge all the risks summed up in the risks section of the report

System Overview

HashPay Wallet provides a mobile app built specifically for Hedera so you can manage your assets and interact with dApps on the go.

Within the app experience, HashPay Wallet focuses on core Hedera flows: creating/importing accounts, sending/receiving HBAR, managing HTS tokens and NFTs, and connecting with Hedera dApps that use the ecosystem’s WalletConnect standard.

Findings

F-2025-1236Lack of Anti-Hook and Anti-Debug Mechanism
Status
fixed
Severity

Low
F-2025-1235Bypassable jailbreak detection
Status
fixed
Severity

Low
F-2025-1237Lack of SSL Pinning
Status
accepted
Severity

Observation
Code
―
Title
Status
Severity
F-2025-1236Lack of Anti-Hook and Anti-Debug Mechanism
fixed

Low
F-2025-1235Bypassable jailbreak detection
fixed

Low
F-2025-1237Lack of SSL Pinning
accepted

Observation
1-3 of 3 findings

Uncover findings like these to secure your project.

Appendix 1. Severity Definitions

Severity

Description

Critical
These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.

High
These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.

Medium
These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.

Low
These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.

  • Severity

    Critical

    Description

    These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.

    Severity

    High

    Description

    These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.

    Severity

    Medium

    Description

    These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.

    Severity

    Low

    Description

    These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.

Appendix 2. Scope

The scope of the project includes the following:

Scope Details

TestFlighthttps://testflight.apple.com/join/FRn8YM7w→
Version1.0.3.13

Assets in Scope

iOS THG Wallet - iOS THG Wallet

Disclaimer