Novaswap Blackbox Pentest
Zealynx ran a seven-day blackbox pentest of the Novaswap frontend dApp and the four Mynth API endpoints it integrates with. The assessment covered application and infrastructure surface, with focus on access control, input handling, error response hygiene, and rate-limiting behavior. Nine issues were identified: one Medium (WAF rate limiting applied per browser session rather than per client), four Low (reflected user input in API validation error messages across multiple endpoints), and four Informational (insufficient access code entropy, reusable shared access code, inactive QR scanner exposed on desktop, publicly accessible OpenAPI specification). All findings were fixed by Novaswap and verified by Zealynx during the validation pass.
Scope
5 filesFindings
click any row for the full write-upKey Findings
- WAF rate limiting applied per browser session rather than per client (M-01, fixed). The Vercel WAF enforced rate limiting and browser-verification challenges scoped to the affected browser session rather than the underlying client. Switching browsers on the same host bypassed the block, reducing the effectiveness of WAF-driven abuse prevention.
- Reflected user input in API validation error messages (L-01 through L-04, fixed). Multiple Mynth API endpoints (
/api/address/balance,/api/address/generate, others) echoed untrusted user input verbatim into validation error responses, including full route + query string in "Route Not Found" errors. Risk is low directly but compounds if responses are rendered by downstream consumers. - Insufficient entropy in access code based access control (I-02, fixed). The access code relied on limited character sets and length, making it vulnerable to brute force under realistic conditions.
- Reusable shared access code allows unlimited unauthorized access (I-03, fixed). A single valid access code could be reused an unlimited number of times across browser sessions, browsers, and devices.
- Inactive QR code scanning feature exposed in desktop web interface (I-01, fixed). A QR feature meant for mobile rendered on desktop, creating user confusion.
- Publicly accessible OpenAPI specification (I-04, fixed). The OpenAPI spec was publicly fetchable, providing attackers an unnecessary map of the backend API surface.
All nine issues were fixed by Novaswap and verified by Zealynx.
Team & approval
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.