Token Generator Pentest - Catapult Trade

1. Introduction

This security assessment was commissioned by Catapult Trade, a Web3 token launch and trading platform that enables creators to launch tokens via automated mechanisms — including bonding curves — and facilitates trading through smart contracts. The assessment was conducted by Halborn, a leading cybersecurity firm specializing in blockchain and Web3 security.

The engagement was scoped to the turbo-token-generator repository at commit b6f2b400, covering the TypeScript-based backend microservice responsible for the Provably Fair chart algorithm — specifically the HKDF-based PRNG seed derivation, token generation endpoint, and associated configuration. The purpose of this engagement was to rigorously evaluate the cryptographic soundness, access control posture, and overall security of the Provably Fair token generation service.

2. Assessment Summary

The assessment was conducted over approximately two days, from May 4th to May 5th. The review was performed by Halborn security specialists with expertise in web application security, TypeScript-based backend systems, and cryptographic protocol analysis.

The primary goals of the engagement were to:

• Validate the cryptographic integrity of the Provably Fair PRNG and HKDF seed derivation pipeline.

• Assess access control and authentication enforcement on sensitive API endpoints.

• Identify configuration and dependency weaknesses that could undermine system security.

The overall security posture of the assessed service requires attention across several high-impact areas. While no critical infrastructure failures were identified, the assessment surfaced a cluster of significant findings that, in combination, could undermine the Provably Fair guarantees the platform relies upon for user trust, as well as expose the service to unauthorized access.

The assessment has identified medium-priority vulnerabilities that could compromise system integrity, specifically through minor cryptographic weaknesses and insufficient access controls. Furthermore, the use of outdated software dependencies exposed the platform to known vulnerabilities and supply chain risks, requiring remediation to protect the infrastructure and ensure a robust security posture.