Executive Summary
A licensed real-world asset (RWA) tokenization and trading platform enables users to subscribe to, redeem, and trade tokenized assets through web and mobile channels. To meet its annual penetration testing requirement under the Monetary Authority of Singapore(MAS), the organization needed an independent assessment of application security and the workflows connecting off-chain services with on-chain execution.
CertiK conducted predominantly manual penetration testing across the in-scope web and mobile surfaces and backend APIs, alongside a review of relevant smart contract components. The engagement provided prioritized findings, remediation guidance, and validation of relevant fixes, establishing a clearer security baseline for the reviewed systems.
Key Challenges
Obtaining Independent Assessment for Annual Security Review
The organization needed an independent penetration testing firm to satisfy its annual testing requirement and assess security risks relevant to regulated operations.
The assessment needed to produce actionable findings and remediation priorities that the team could use to address weaknesses across the reviewed systems and follow up on implementation changes.
Protecting Accounts and Asset Workflows Across Multiple Interfaces
The platform combined customer-facing web and mobile channels with operator and enterprise functions, including asset issuance and user management. These interfaces created multiple entry points into services handling tokenized assets and sensitive administrative actions.
Weaknesses in access control, session handling, or business logic could lead to account takeover, loss of funds, or disruption of trading and redemption. The assessment therefore needed to consider risks across both customer activity and the functions used to operate and administer the service.
Assessing Risks Between Applications and Smart Contracts
The off-chain platform coordinated smart contract interactions for asset and transaction workflows. Security depended on how application logic and on-chain execution worked together, including the controls applied as activity moved between them.
Trust-boundary or integrity gaps at this integration layer could affect transaction authorization and execution. The organization needed an assessment that considered these connections alongside the security of its application interfaces.
CertiK’s Solution
Mapping the Attack Surface Around High-Value Workflows
CertiK performed structured reconnaissance across the in-scope web and mobile surfaces and backend APIs. The work identified exposed assets, entry points, and high-value workflows to establish a view of the attack surface before deeper testing.
This provided a basis for directing the assessment toward interfaces and processes with potential consequences for customer accounts, asset transactions, and operator functions.
Combining Manual Penetration Testing With Integration Review
CertiK conducted predominantly manual, attack-driven penetration testing aligned with OWASP Top 10 and the OWASP Application Security Verification Standard (ASVS), supported by tools where relevant.
Manual testing allowed reviewers to examine how exposed application functions could be misused within the reviewed workflows. CertiK also reviewed relevant on-chain smart contract components to assess risks in how the off-chain platform coordinated blockchain interactions. This connected application testing with the security considerations of the associated on-chain workflows.
Supporting Triage, Remediation, and Fix Validation
CertiK provided prioritized remediation guidance and maintained active communication with the platform’s team throughout triage and remediation. Reviewers answered technical questions, clarified findings, and validated relevant fixes.
This gave the team technical support as it worked through identified issues and provided independent follow-up on the implementation changes reviewed during the engagement.
Value Delivered
Clear Priorities for Remediation
The assessment gave the organization a prioritized view of security findings across the reviewed scope. The accompanying guidance helped the team determine which issues required greater attention and plan the relevant technical follow-up.
Remediation Support and Independent Verification
The platform’s team received continued technical support during remediation, with CertiK answering implementation questions and validating relevant fixes. This provided independent feedback on reviewed changes and helped the team track remediation progress.
A Security Baseline for Regulated Operations
The engagement supported the organization’s annual penetration testing requirement and established a clearer reference for application security and the risks associated with connected on-chain workflows.
The findings and remediation follow-up provided technical input for ongoing security governance and subsequent platform reviews. The conclusions remained tied to the components and changes assessed within the engagement.
Operating or Expanding a Tokenized Asset Trading Platform?
CertiK helps your team identify security risks in the systems behind asset subscriptions, trading, and redemption. Clear findings and verification of relevant fixes support decisions about ongoing operations and platform updates.
