Pentesting PRDT.finance

Introduction

At Borg Security, our mission is to protect and strengthen Web3 platforms against emerging cybersecurity threats. In a recent security assessment, we identified an opportunity to enhance the already robust security framework of PRDT, a leading decentralized financial platform. In line with our commitment to safeguarding the Web3 ecosystem, we collaborated with PRDT to further improve their security defenses.

This case study outlines how we identified a vulnerability in PRDT’s authentication system and worked together to quickly resolve it. Our proactive collaboration helped to mitigate potential risks and reinforced the platform’s security, ensuring ongoing user trust and integrity.

Scope of the Security Analysis

PRDT.finance, a rapidly growing decentralized trading platform, demonstrated strong security foundations. However, our thorough security assessment uncovered a potential vulnerability related to the platform’s user authentication process. Our goal was to identify and rectify any risks to further enhance the security of PRDT’s users and operations.

Key Findings

During our detailed review, we identified a vulnerability in the login process:

Signature Validation Vulnerability

The API at https://api.prdt.finance/auth/verify, which handles user authentication via signed messages, was found to have incomplete message validation. While this issue had not been exploited, it presented a potential risk where malicious actors could attempt unauthorized access under certain conditions.

A possible scenario involved:

An attacker setting up a similar website to collect signed messages from users via Metamask. Reusing those signed messages to access users' PRDT accounts and potentially authorize transactions.

By addressing this issue, PRDT ensured continued protection for users’ accounts and funds.

Our Approach to Identifying Vulnerabilities

Reconnaissance We meticulously mapped the authentication flow and examined the API endpoints involved in the login process to detect any potential weaknesses.

Exploit Testing We conducted controlled testing to verify whether signed messages from external sources could bypass the system’s authentication controls. This confirmed the potential risk.

Risk Assessment We analyzed the severity of the vulnerability and worked swiftly to recommend fixes that would eliminate any possibility of unauthorized access.

Collaborative Response and Solutions

Upon identifying the vulnerability, our team promptly informed PRDT and worked closely with them to resolve the issue:

Enhanced Message Validation We recommended a comprehensive message validation protocol, ensuring that all elements of the signed message—such as the URI and version—are securely tied to PRDT’s platform, preventing unauthorized access from other sources. This has already been implemented by their development team.

Ongoing Security Collaboration We encouraged PRDT to conduct regular security assessments and maintain vigilant monitoring to stay ahead of evolving threats.

How Can Borg Security Help Your Business?

Borg Security offers expert cybersecurity solutions tailored to the needs of Web3 and decentralized platforms. Our comprehensive security assessments, penetration testing, and risk management services are designed to protect your infrastructure and enhance your security posture. With our support, you can navigate the complex security landscape confidently and safeguard your platform and users.

Contact us at Borg Security to learn how we can help you fortify your systems and stay ahead of emerging cybersecurity challenges.