Penetration Test

Introduction#

HSuite engaged Halborn to conduct a security assessment of the new transaction-related updates to SilkDEX. The engagement was carried out between the 8th of September 2026 and the 16th of September 2026. The security assessment was scoped to the assets and environments agreed upon with the HSuite team.

Assessment Summary#

The team at Halborn was provided 7 days for the engagement and assigned a full-time security engineer to verify the security of the assets in scope. The security engineer is a penetration testing expert with advanced knowledge in web, recon, discovery & infrastructure penetration testing.

The goals of our security assessments are to improve the quality of the systems we review and to target sufficient remediation to help protect users.

Scope

The security assessment was scoped to the two new updates to the DEX:

• Pools may now be created between arbitrary asset pairs, with neither side being HSUITE, SILK, or any other hub token.

• A set of improvements was made to the automated rebalancing engine.

The assessment identified weaknesses primarily relating to logic-level resource controls and information disclosure rather than direct exploitability. A resource exhaustion issue was identified coming from insufficient logic-level throttling, whereby repeated use of legitimate application functionality could exhaust backend resources, potentially resulting in degraded availability or Denial-of-Service conditions. A permissive pool creation was also observed, wherein the application allowed the creation of resource pools with insufficiently restrictive controls, which could be leveraged to create unintended attack surface over time. Finally, verbose error messages were identified that could disclose internal implementation details, potentially aiding an attacker in reconnaissance.

Addressing the identified findings is important in order to reduce the organization's exposure to both opportunistic and targeted adversarial campaigns.

Test Approach and Methodology#

Halborn performed a combination of manual and automated security testing to balance efficiency, timeliness, practicality, and accuracy regarding the scope of the assessment. While manual testing is recommended to uncover flaws in logic, process and implementation; automated testing techniques assist enhance coverage of the infrastructure and can quickly identify flaws in it.

Testing was black-box against the isolated testnet environment, with no source access, only the public client API and funded test accounts. Custom tests covered tampering with transaction bytes between quote and execute, replay and cross-account signing, authentication abuse and parallel concurrency. Test cases spanned pool admission, routing, settlement atomicity and fees, the rebalancing engine, liquidity economics, concurrency, cross-pool contamination, access control, input validation, and resource abuse. All economic results were verified to confirm what actually settled on chain. Volumetric Denial-of-Service was out of scope.

The following phases and associated tools were used throughout the term of the assessment:

• Application logic flaws

• Areas where insufficient validation allows for hostile input

• Input handling

• Fuzzing of input parameters

• Technology stack-specific vulnerabilities and code assessment

• Application Logic Flaw

• Response Manipulation

• Sensitive data leakage

• Configuration review

• Access controls

• API subscription key bypass

Risk Methodology#

Scope#