Novaswap

Novaswap Blackbox Pentest

Zealynx ran a seven-day blackbox pentest of the Novaswap frontend dApp and the four Mynth API endpoints it integrates with. The assessment covered application and infrastructure surface, with focus on access control, input handling, error response hygiene, and rate-limiting behavior. Nine issues were identified: one Medium (WAF rate limiting applied per browser session rather than per client), four Low (reflected user input in API validation error messages across multiple endpoints), and four Informational (insufficient access code entropy, reusable shared access code, inactive QR scanner exposed on desktop, publicly accessible OpenAPI specification). All findings were fixed by Novaswap and verified by Zealynx during the validation pass.