All Your Base

All Your Base Web Game Pentest

Zealynx ran a one-week blackbox penetration test of the All Your Base betting game (allyourbase.virtual.tech), a NestJS-backed web2 application that interfaces with smart contracts for token price prediction bets. Four issues were identified: one High (decimals not handled by the application frontend, producing exponential session-balance values), two Medium (content spoofing via url/w/q parameters in both unauthenticated and authenticated states; improper error handling in those same parameters), and one Informational (Strict-Transport-Security not enforced). All four were acknowledged at the time of report publication.