Audit name:
[PT] WhiteBIT | iOS | Jul2026
Date:
Sep 4, 2026
Table of Content
Introduction
We express our gratitude to the WhiteBIT team for the collaborative engagement that enabled the execution of this Pentest.
Document | |
|---|---|
| Name | iOS Mobile Application Pentest and Security Analysis Report for WhiteBIT |
| Approved By | Faizan Nehal |
| Website | https://whitebit.com, https://whitebit.com/ua |
| Changelog | 05/08/2026 - Preliminary Report |
| Changelog | 07/09/2026 - Final Report |
| Platform | İOS |
| Tags | Mobile Application - iOS |
| Methodology | https://docs.hacken.io/methodologies/pentesting→ |
Document
- Name
- iOS Mobile Application Pentest and Security Analysis Report for WhiteBIT
- Approved By
- Faizan Nehal
- Website
- https://whitebit.com, https://whitebit.com/ua
- Changelog
- 05/08/2026 - Preliminary Report
- Changelog
- 07/09/2026 - Final Report
- Platform
- İOS
- Tags
- Mobile Application - iOS
Review Scope | |
|---|---|
| Appstore | https://apps.apple.com/ua/app/whitebit-buy-sell-bitcoin/id1463405025→ |
| Version | 3.79.1. |
| Re-test Version | 3.82.1 |
Review Scope
- Version
- 3.79.1.
- Re-test Version
- 3.82.1
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
{FindingsVulnSeverityStatusTable}
System Overview
WhiteBIT is a centralized cryptocurrency exchange founded in 2018. The platform provides cryptocurrency trading, asset management, deposit and withdrawal services, and supports spot, margin, and futures trading. According to WhiteBIT's official information, the exchange supports more than 330 digital assets and 780 trading pairs.
The assessed iOS application enables users to:
Register and authenticate their accounts.
Manage cryptocurrency balances.
Deposit, withdraw, and transfer digital assets.
Perform spot, margin, and futures trading.
View transaction history and account information.
Manage account and security settings.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2026-1884 | WebSocket Authorization Bypass via Unenforced API Key Permissions | fixed | Medium | |
| F-2026-1883 | OTA (CodePush) Bundle Signature Verification Not Configured | fixed | Medium | |
| F-2026-1884 | Unhandled Exceptions Disclose Internal Database Error Information | fixed | Low | |
| F-2026-1884 | Lack of Input Validation in Branded QR Code Generation | fixed | Low | |
| F-2026-1883 | Overly Permissive CORS Policy on cc.whitebit.com | fixed | Low | |
| F-2026-1885 | Application Lock Passcode Is Enforced Entirely on the Client Side | fixed | Observation | |
| F-2026-1885 | Missing JWT Access Token Expiration | accepted | Observation | |
| F-2026-1885 | Jailbreak Detection Is Present but Not Enforced | accepted | Observation | |
| F-2026-1884 | Session Token Stored in Keychain Without Biometric Access Control | accepted | Observation | |
| F-2026-1883 | Certificate Pinning Not Implemented for Primary API Communications | accepted | Observation |
Appendix 1. Severity Definitions
Findings are categorized based on their potential impact and assigned a severity level using the Common Vulnerability Scoring System (CVSS) version 4.0: →
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following
Review Scope | |
|---|---|
| Appstore | https://apps.apple.com/ua/app/whitebit-buy-sell-bitcoin/id1463405025→ |
| Version | 3.79.1. |
| Version | 3.82.1 |
Review Scope
- Version
- 3.79.1.
- Version
- 3.82.1
Assets in Scope
Appendix 3. Additional Valuables
Frameworks and Methodologies
This security assessment was conducted in alignment with recognised penetration testing standards, methodologies and guidelines, including the NIST SP 800-115 – Technical Guide to Information Security Testing and Assessment →, the Penetration Testing Execution Standard (PTES) →, and the OWASP Testing Guide →. These assets provide a structured foundation for planning, executing, and documenting technical evaluations such as vulnerability assessments, exploitation activities, and security code reviews. Hacken’s internal penetration testing methodology extends these principles to Web2 and Web3 environments to ensure consistency, repeatability, and verifiable outcomes.