Audit name:
[PT] Toobit | Web+API | Jul2026
Date:
Aug 17, 2026
Table of Content
Introduction
We express our gratitude to the Toobit team for the collaborative engagement that enabled the execution of this Pentest.
Toobit is a cryptocurrency exchange platform that enables users to buy, sell, and trade a wide range of digital assets. It provides mobile and web interfaces for real-time trading, asset management, and wallet services. The system is designed to support high-throughput order execution, secure asset custody, and user account protection.
Document | |
|---|---|
| Name | Pentest and Security Analysis Report for Toobit |
| Audited By | Faizan Nehal |
| Approved By | Ece Orsel |
| Website | https://www.toobit.com/→ |
| Changelog | 31/07/2026 - Preliminary Report |
| Changelog | 14/08/2026 - Final Report |
| Platform | Web & API |
| Methodology | https://docs.hacken.io/methodologies/pentesting→ |
Document
- Name
- Pentest and Security Analysis Report for Toobit
- Audited By
- Faizan Nehal
- Approved By
- Ece Orsel
- Website
- https://www.toobit.com/→
- Changelog
- 31/07/2026 - Preliminary Report
- Changelog
- 14/08/2026 - Final Report
- Platform
- Web & API
Review Scope | |
|---|---|
| Web Application | https://toobit.com→ |
| Commit | https://api.toobit.com/→ |
Review Scope
- Web Application
- https://toobit.com→
- Commit
- https://api.toobit.com/→
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
{FindingsVulnSeverityStatusTable}
System Overview
Toobit is a cryptocurrency trading platform that provides users with access to spot and derivatives markets, account management, wallet-related functions, and community-oriented features through its web application. Users can register, authenticate, manage their profiles, deposit or withdraw supported digital assets, place trading orders, monitor market prices, and interact with social content such as insights, comments, replies, and reactions. The platform is designed to support both trading activity and user engagement within a single browser-based interface.
The web application communicates with Toobit’s backend through a set of HTTP APIs hosted across dedicated service domains, including endpoints responsible for authentication, market data, trading operations, user settings, and social features. These APIs process authenticated requests using session cookies or access tokens and rely on identifiers such as post tokens and comment tokens to reference specific resources. The backend is responsible for validating requests, enforcing account and object-level permissions, storing user-generated content, and returning structured responses to the frontend.
From a security perspective, the application and API handle sensitive financial, account, and user-generated data, making authentication, authorization, session management, and input validation particularly important. Access controls must be consistently enforced across all endpoints, especially where private insights, comments, replies, wallet operations, and trading functions are involved. The system should ensure that users can only view or modify resources for which they have explicit permission, while also protecting against common web and API risks such as broken object-level authorization, session abuse, information disclosure, rate-limit bypasses, and unauthorized state-changing actions.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2026-1875 | Broken Object-Level Authorization Exposes Comments on Private Insights | fixed | Medium | |
| F-2026-1875 | Broken Access Control Allows Unauthorized Access to Private Insights and Their Comments | fixed | Medium | |
| F-2026-1875 | IDOR Allows Unauthorized Comments on Other Users’ Private Insights | fixed | Medium | |
| F-2026-1875 | Broken Access Control Allows Private User Insights to Be Disclosed Through Reposting | fixed | Medium | |
| F-2026-1875 | Insufficient Rate Limiting Allows Mass Creation of Abnormal Deposit Support Tickets | fixed | Medium | |
| F-2026-1875 | Private Insight Comments Can Be Liked by Other Users | accepted | Low | |
| F-2026-1875 | Broken Object-Level Authorization in Comment Translation Endpoint Discloses Private Comment Content | accepted | Low | |
| F-2026-1875 | IDOR Allows Unauthorized Likes on Other Users’ Private Insights | accepted | Low | |
| F-2026-1874 | CSRF Allows an Attacker to Stop a User’s Active Strategy Trading Bot | accepted | Low | |
| F-2026-1874 | Futures Account Enumeration Through Distinct Error Responses | accepted | Low |
Appendix 1. Severity Definitions
Findings are categorized based on their potential impact and assigned a severity level using the Common Vulnerability Scoring System (CVSS) version 4.0: →
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following:
Scope Details | |
|---|---|
| Web Application | https://toobit.com→ |
| API | https://api.toobit.com/→ |
Scope Details
- Web Application
- https://toobit.com→
Appendix 3. Additional Valuables
Frameworks and Methodologies
This security assessment was conducted in alignment with recognised penetration testing standards, methodologies and guidelines, including the NIST SP 800-115 – Technical Guide to Information Security Testing and Assessment →, the Penetration Testing Execution Standard (PTES) →, and the OWASP Testing Guide →. These assets provide a structured foundation for planning, executing, and documenting technical evaluations such as vulnerability assessments, exploitation activities, and security code reviews. Hacken’s internal penetration testing methodology extends these principles to Web2 and Web3 environments to ensure consistency, repeatability, and verifiable outcomes.