Introduction
We express our gratitude to the Zoomex team for the collaborative engagement that enabled the execution of this Pentest.
Document | |
|---|---|
| Name | Pentest and Security Analysis Report for Zoomex |
| Audited By | |
| Approved By | |
| Website | http://zoomex.com/→ |
| Changelog | 17/09/2025 - Preliminary Report |
| Changelog | 23/10/2025 - Final Report |
| Language | Swift |
| Tags | iOS Mobile Application Pentest |
| Methodology | https://hackenio.cc/pentest_methodology→ |
| Platform | iOS |
Document
- Name
- Pentest and Security Analysis Report for Zoomex
- Audited By
- Approved By
- Website
- http://zoomex.com/→
- Changelog
- 17/09/2025 - Preliminary Report
- Changelog
- 23/10/2025 - Final Report
- Language
- Swift
- Tags
- iOS Mobile Application Pentest
- Methodology
- https://hackenio.cc/pentest_methodology→
- Platform
- iOS
Review Scope | |
|---|---|
| App Store | https://apps.apple.com/app/zmex-crypto-bitcoin-trading/id6711352543→ |
| Version | 3.10.7 |
| Retest Version | 3.11.0 |
Review Scope
- Version
- 3.10.7
- Retest Version
- 3.11.0
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
System Overview
Zoomex, established in 2021, is a rapidly growing cryptocurrency exchange platform designed to deliver a secure, transparent, and efficient trading experience to millions of users worldwide. Built on advanced blockchain and financial technologies, Zoomex focuses on combining reliability, high performance, and user-centric innovation.
The platform offers a wide range of trading services including Contract Trading, Spot Trading, Copy Trading, and the Trade Arena, enabling traders to pursue diverse strategies within a single ecosystem. Its high-performance trading engine ensures low-latency execution and supports high transaction volumes without compromising stability or security.
Security is a core priority for Zoomex. The platform implements industry-leading measures such as cold wallet storage, two-factor authentication, advanced risk management systems, and continuous monitoring to safeguard user assets and data. These mechanisms are complemented by robust compliance processes designed to meet global regulatory requirements.
Zoomex also distinguishes itself through its community-driven approach. By actively integrating user feedback into product development, the platform continually improves functionality, user interface, and overall trading experience. Educational resources, promotional events, and an intuitive interface make it accessible for beginners, while advanced analytical tools and trading features meet the demands of professional investors.
In summary, Zoomex positions itself as a trusted and innovative digital asset exchange, striving to deliver excellence in security, performance, and user experience, and reinforcing its place as a leading player in the global crypto trading landscape.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2025-1289 | Sensitive Data Stored in HiveDB without Encryption | fixed | Medium | |
| F-2025-1289 | Sensitive OAuth Tokens Stored in Keychain | accepted | Medium | |
| F-2025-1303 | No Strong Encryption Declared | accepted | Low | |
| F-2025-1303 | Default Data Protection Class (NSFileProtectionCompleteUntilFirstUserAuthentication) | accepted | Low | |
| F-2025-1303 | Insecure App Transport Security (ATS) Settings | accepted | Low | |
| F-2025-1288 | Lack of Code Obfuscation | accepted | Low | |
| F-2025-1288 | Sensitive Data Exposure via iOS Pasteboard | accepted | Low | |
| F-2025-1288 | Lack of Restriction on Third-Party Keyboards | accepted | Low | |
| F-2025-1288 | Sensitive Information Exposure in App Switcher and Snapshots | accepted | Low | |
| F-2025-1287 | Lack of Anti-Hook and Anti-Debug Mechanism | accepted | Low |
Appendix 1. Severity Definitions
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following
Review Scope | |
|---|---|
| App Store | https://apps.apple.com/app/zmex-crypto-bitcoin-trading/id6711352543→ |
| Version | 3.10.7 |
Review Scope
- Version
- 3.10.7