Apriorit Inc.

The client approached us with a request for auditing the security of a crypto wallet application that was recently updated and a new smart contract-based dApp for the Tezos blockchain

As the wallet code had been updated, the client wanted to make sure that all critical data and financial operations the wallet works with remained secure and well-protected

They also wanted to test their dApp through and through and make sure their smart contracts were flawless before releasing them to the mainnet

After a thorough security audit for the crypto wallet and dApp, the Apriorit team discovered several low- and medium-risk vulnerabilities in the wallet and smart contracts We also found a logical error in the bot application of the client’s dApp

Thanks to timely updates from the Apriorit team, our client was able to eliminate most vulnerabilities shortly after they were discovered Once we re-checked the fixed code, we provided the client with a detailed report and recommendations on how to address the remaining security issues

The project was successful, helping increase customer confidence in the system’s security For a cost-effective fee, Apriorit worked efficiently and delivered excellent results They communicated well, ensuring their partners felt like they were on the same page throughout the engagement Read more » (Extract from the independent review on Clutch co) For this project, Apriorit formed a team of competent blockchain developers familiar with the technology stack requested by the client

We also assigned an experienced project manager to this team to ensure efficient and timely cooperation between our specialists and the client

After getting familiar with the project, we outlined key security risks for the crypto wallet and dApp to focus on during the audit: For both the wallet and dApp, we outlined four main auditing activities:

• Unit test coverage analysis
• Testing for unexpected behavior We also evaluated the overall quality of the source code for each of the audited products

The entire process was split into three stages: Twice a week, we sent the client a short report with up-to-date information on all discovered security vulnerabilities and their statuses This way, the client could make a timely decision on whether to fix a certain security issue or not and have us re-check the improved code if necessary

Let’s briefly go over each of these stages

Stage 1. Planning and discussion

We started with analyzing the client’s request and the project’s specifics, determining the focal points for the audit, and selecting tools and techniques

For this audit, we outlined several objectives:

• Evaluate the exposure of the wallet and dApp to known security vulnerabilities
• Determine potential attack vectors
• Check if any detected vulnerabilities can be exploited maliciously Once the preliminary plan and audit schedule were prepared and approved by the customer, we moved to the main stage — running the actual audit

Stage 2. Audit of the wallet and dApp

First, let’s take a look at some key points of the wallet audit

Auditing the blockchain wallet

The client had a desktop wallet application written in TypeScript Users can use this app to see their balances, send new transactions, and review their operation histories To connect to the Tezos blockchain network, this wallet uses a custom library

We assessed the security of the wallet in three steps: