Valinity Application

CertiK28 Oct 2022Code version: not recorded (see the report)

Audit

CertiK reviewed Valinity (Valinity Application) on 28 Oct 2022: 16 findings, 0 critical; 13 marked fixed, 3 open.

No open critical findings

Open the report Open Valinity’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings16

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	0
Medium	0	4
Low	3	9

MediumEBS Volume Not EncryptedFixed

During testing, the testers found that the AWS EBS volumes for the `My Freedom Coin` project were not encrypted.

MediumLack of Key Rotation for (Active) DaysFixed

During testing, the testers found that `My Freedom Coin` project did not configure the Rotate Access Keys policy.

MediumMnemonic display allow screenshotFixed

The mnemonic phrase is a list of words that can be used to recover a wallet account. Obtaining the mnemonic can potentially allow the attacker to gain full control of the wallet. The application neither has a mechanism in place to stop a user from taking the screenshot of the displayed wallet secrets nor display a warning to remind the user of the risk of taking a screenshot.

MediumPasscode retry limit bypassFixed

The passcode retry time limit prevents an attacker from brute-forcing the user's passcode. However, it was found that the time limit can be bypassed by going back to the parent menu and then re-entering the enter passcode screen.

LowActivity is not ProtectedFixed

When analyzing the `AndroidManifest.xml` file, the testers found that the Activity of `com.myfreedomcoin.mfc.MainActivity` was not protected due to the setting of `exported=true`.

LowApplication uses v1 signature scheme (Janus AttacFixed

The application is signed with v1 signature scheme, making it vulnerable to Janus vulnerability on Android <7.0 The Janus vulnerability stems from the possibility to add extra bytes to APK files and to DEX files. On the one hand, an APK file is a zip archive, which can contain arbitrary bytes at the start, before its zip entries (actually more generally, between its zip entries). The JAR signature scheme only takes into account the zip entries. It ignores any extra bytes when computing or verifying the application’s signature. On the other hand, a DEX file can contain arbitrary bytes at the end, after the regular sections of strings, classes, method definitions, etc. A file can, therefore, be a valid APK file and a valid DEX file at the same time. References: https://www.xda-developers.com/janus-vulnerability-android-apps/

LowDomain Transfer Not LockedFixed

During the test, the testers found that the domain name of `My Freedom Coin` was not set to transfer lock.

LowInsecure AWS IAM Password PolicyFixed

During testing, the testers found that there were many insecure password policy issues in the `My Freedom Coin` AWS environment. The following problems exist. - Password Expiration Disabled - Password Policy Allows the Reuse of Passwords

LowInsecure security groups configurationFixed

During testing the testers found that there were many problems with the insecure security group configuration in the `My Freedom Coin` project. The following problems exist. - Default Security Groups in Use - Non-empty Rulesets for Default Security Groups - Security Group Opens All Ports - Security Group Uses Port Range - Unrestricted Network Traffic within Security Group

LowInsecure subnet configurationFixed

During testing, the testers found the following problems with subnet. - Subnet with "Allow All" egress NACLs - Subnet with "Allow All" ingress NACLs - Subnet without a Flow Log

Show 3 more

LowNo root detection on Android applicationFixed

No root or jailbreak detection is implemented in the application. This allows an attacker to modify the app on a rooted Android or jailbroken iOS device, which means the attacker can potentially induce behaviors that otherwise would not occur. Examples of the impact include accessing sensitive application data, overwriting critical functions, and an overall wider attack surface.

LowScreenshot backgroundingFixed

On mobile devices, a screenshot of the current activity is taken when an application goes into the background and displayed for aesthetic purposes when the app returns to the foreground. This feature may pose a security risk. Sensitive data may be exposed if the user background the application while sensitive data is displayed. A malicious application that is running on the device and able to continuously capture the screen may also expose data. ![31YQA3@U[]ERG0J}LT1$6A6_1658798685785.png =200x370](https://accelerator-projects-prod.acc.corp.certik.com/a9230c00-e7a1-11ec-9959-35b12e4ad977/upload/31YQA3%40U%5B%5DERG0J%7DLT1%246A6_1658798685785.png)

LowUsing components with known vulnerabilitiesFixed

The result of the "npm audit" command shows the application is using outdated libraries with know vulnerabilities.