Audit name:
[PT] VOOX | Android | Jan2025
Date:
Feb 4, 2025
Table of Content
Introduction
We express our gratitude to the VOOX team for the collaborative engagement that enabled the execution of this Pentest.
VOOX is an AI-driven cryptocurrency exchange platform founded in 2022 which offers a comprehensive suite of services, including spot, margin, and futures trading, as well as copy trading and AI-based intelligent trading strategies. The platform is designed to cater to both novice and experienced traders, aiming to enhance user experience and maximize trading potential through advanced AI integration.
Document | |
|---|---|
| Name | Pentest and Security Analysis Report for VOOX |
| Audited By | Adedolapo Olayinka-Adeyemi |
| Approved By | Stephen Ajayi |
| Website | https://www.voox.com→ |
| Changelog | 13/01/2025 - Preliminary Report |
| Changelog | 04/02/2025 - Final Report |
| Platform | Android |
| Language | Java |
| Tags | Pentest, GrayBox |
| Methodology | https://hackenio.cc/pentest_methodology→ |
Document
- Name
- Pentest and Security Analysis Report for VOOX
- Audited By
- Adedolapo Olayinka-Adeyemi
- Approved By
- Stephen Ajayi
- Website
- https://www.voox.com→
- Changelog
- 13/01/2025 - Preliminary Report
- Changelog
- 04/02/2025 - Final Report
- Platform
- Android
- Language
- Java
- Tags
- Pentest, GrayBox
- Methodology
- https://hackenio.cc/pentest_methodology→
Review Scope | |
|---|---|
| Repository | https://www.voox.com/en_US/appDownload→ |
| Commit | version 1.1.3 |
Review Scope
- Repository
- https://www.voox.com/en_US/appDownload→
- Commit
- version 1.1.3
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
System Overview
VOOX is an AI-driven cryptocurrency exchange platform founded in 2022 and headquartered in Singapore. It offers a comprehensive suite of services, including spot, margin, and futures trading, as well as copy trading and AI-based intelligent trading strategies. The platform is designed to cater to both novice and experienced traders, aiming to enhance user experience and maximize trading potential through advanced AI integration.
Android Application Overview:
Voox mobile application offers a comprehensive suite of services including spot, margin, and futures trading, along with copy trading and AI-based intelligent trading strategies. Key features inckude:
AI Integration: Sophisticated AI tools provide predictive analytics, automated trading, and personalized insights.
User-Centric Interface: An intuitive interface simplifies trading processes and improves accessibility.
Real-Time Trading: Access live price feeds, execute trades, and manage orders directly from mobile devices.
Security Measures: encrypted communication traffic, detection of rooted and security flawed mobile phone, two-factor authentication.
Portfolio Management: Monitor account balances, transaction history, and performance metrics in an organized and intuitive layout.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2025-8106 | Attribute hasFragileUserData Not Set | fixed | Low | |
| F-2025-8104 | Insecure File Provider Paths Setting | fixed | Low | |
| F-2025-8087 | Missing Component Permission in AndroidManifest.xml | fixed | Low | |
| F-2025-8108 | Services Declared Without Permissions | fixed | Observation | |
| F-2025-8107 | Attribute usesCleartextTraffic Set | fixed | Observation |
Appendix 1. Severity Definitions
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following:
Scope Details | |
|---|---|
| Android | https://www.voox.com/en_US/appDownload→ |
| version | version 1.1.0 |
Scope Details
- version
- version 1.1.0