Audit name:
[PT] Zoomex | Web Application & API | Jun2024
Date:
Jul 12, 2024
Table of Content
Introduction
We express our gratitude to the Zoomex team for the collaborative engagement that enabled the execution of this Pentest.
Zoomex was established in 2021 as a cryptocurrency exchange platform that masters cutting-edge blockchain technology. It provides secure, reliable, and transparent digital asset trading services to millions of users worldwide.
Document | |
|---|---|
| Name | dApp Code Review and Security Analysis Report for Zoomex |
| Audited By | |
| Approved By | |
| Website | https://hacken.io→ |
| Changelog | 07/07/2024 - Final Report |
| Platform | https://zoomex.com→ |
| Methodology | https://hackenio.cc/dApp_methodology→ |
Document
- Name
- dApp Code Review and Security Analysis Report for Zoomex
- Audited By
- Approved By
- Website
- https://hacken.io→
- Changelog
- 07/07/2024 - Final Report
- Platform
- https://zoomex.com→
- Methodology
- https://hackenio.cc/dApp_methodology→
Penetration Testing Scope | |
|---|---|
| Web Application | https://zoomex.com/→ |
| Web API | https://api2.zoomex.com/→ |
Penetration Testing Scope
- Web Application
- https://zoomex.com/→
- Web API
- https://api2.zoomex.com/→
Audit Summary
After conducting a comprehensive security assessment and rigorous testing procedures, we have confirmed that the application adheres to high standards of security and reliability. Our thorough evaluations, combined with the mitigation strategies and remediation measures implemented by the client, have led us to conclude that the centralized exchange (CEX) exhibits a strong level of security.
ZOOMEX IS SECURE.
System Overview
Zoomex was established in 2021. Zoomex is a cryptocurrency exchange platform that masters cutting-edge blockchain technology. It provides secure, reliable, and transparent digital asset trading services to millions of users worldwide.
Zoomex focus on the needs and voices of each user. It supports Contract Trading, Spot Trading,Copy Trading & Trade Arena
Web Application: https://zoomex.com/5
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2024-4042 | Unauthorized Fund Transfer | fixed | Critical | |
| F-2024-4028 | Improper KYC Verification Allows Account Creation with Stolen Identities | accepted | High | |
| F-2024-4019 | Access Control Issue: Apply For Zoomex VIP Club On Behalf Of Other Users | fixed | Medium | |
| F-2024-4004 | Response Manipulation to Bypass 2FA Verification When Changing Phone Number | accepted | Medium | |
| F-2024-3998 | Response Manipulation To Bypass Email Code Verification While Activating 2FA | accepted | Medium | |
| F-2024-4043 | Vulnerable JavaScript Dependency | accepted | Low | |
| F-2024-4009 | Bypass Nickname Length Verification | fixed | Observation |
Appendix 1. Severity Definitions
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following web assets:
Scope Details | |
|---|---|
| Web Application | https://zoomex.com/→ |
| Web API | https://api2.zoomex.com/→ |
| Whitepaper | - |
| Requirements | |
| Technical Requirements |
Scope Details
- Web Application
- https://zoomex.com/→
- Web API
- https://api2.zoomex.com/→
- Whitepaper
- -
- Requirements
- Technical Requirements