Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.deManagement Summary: Cake DeFi UI, API & Server
Security Assessment by Cure53, 04.2022
Cure53, Dr.-Ing. M. Heiderich, N. Hippert, MSc. R. Peraglie, BSc. B. Walny
Cure53, which is a Berlin-based IT security consultancy, completed a security assessment
against the user-facing parts of the Cake Pte. Ltd. software complex, spanning the Cake DeFi
UI, backend API, and underlying servers. The project executed by Cure53 entailed apenetration test and a general review of the observable security premise. By investigating thescope through a range of methods, Cure53 acquired evidence-based knowledge about thescope and can now issue a verdict about its robustness.
In the frames of this cooperation, a team of four Cure53 testers, all with expertise matching theproject’s goals, invested a total of thirteen person-days into this assignment. The work waspredominantly carried out in February 2022, namely CW06 through CW07, with the main tasks
ascribed to two distinct Work Packages (WPs).
••

WP1: Grey-box penetration tests against Cake DeFi web UI and JavaScript
WP2: Grey-box penetration tests against Cake DeFi backend API and server

Prior to highlighting the contents of the two WPs, it is important to comment on the methods
employed for this project. The overarching approach was a grey-box methodology. The Cure53
testing team was given information on how to create and leverage test-users and test-data,accompanied by test-supporting documentation and API documentation. This level of clarity ofthe scope also meant neither technical nor other problems occurred during the assessment.
The Cake Pte. Ltd. team responsible for the application in scope was highly engaged in making
sure that the envisioned attack surface is fully test-ready by the project’s start date set for theFebruary project. Dedication to preparatory stages enabled timely and efficient progress of thisCure53 assessment. For each of the aforementioned components in scope, Cure53 conductedsecurity reviews and penetration testing.
Communications during this engagement took place in a dedicated, private and shared Slackchannel, which connected the Cake Pte. Ltd. and Cure53 workspaces and enabled the involved
team members from both sides to join in. Keeping the Cake Pte. Ltd. team apprised of theprogress, the Cure53 team reported the number and headlines of the spotted findings on analmost daily basis.

Cure53, Berlin · 04/27/22

1/2

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de

Live-reporting was executed using the same communications channel, leading to several timely
fixes being authored by Cake Pte. Ltd. developers. Speaking of the findings, the Cure53 testers
have made ten security-relevant discoveries on the Cake DeFi web application scope. Threeproblems were categorized as vulnerabilities and seven as general weaknesses.
Generally speaking, the overall volume of findings detected should be considered relatively
moderate for a framework of this complexity and magnitude. This is evidently a positive
indication regarding the security posture of the components and aspects included in thisparticular scope. Notably, all findings were assigned Medium-severity ratings or even lower.
Additionally, the majority were only considered general weaknesses that are trivially easy toaddress and mitigate.
Throughout the testing process and after its conclusion, the Cake Pte. Ltd. team responded to
the reported issues with swift action and comprehensive mitigation strategies.
In conclusion, the application architecture had some weaknesses in its design and architecture,
which were addressed by Cake Pte. Ltd early on after the reporting from Cure53. Typicallywidespread issues such as XSS, SQLi, and to a large extent ACL controls seem to be undercontrol thanks to the correct usage of well-known frameworks, which contributes to the positiveimpression gained on the whole. However, Cure53 strongly recommends initiating acomprehensive code audit for future assessments to detect even the most deeply-entrenchedframework weaknesses.
This positive impression has been confirmed with the subsequent stages of fix verification.
Cure53 can confirm that all relevant findings received due attention and should be consideredresolved. For fix verification purposes, Cure53 had access to the detailed fix descriptions andscreenshots highlighting the code and configuration changes, the information was presented ina very structured way and enabled Cure53 to perform a refreshingly efficient review process.
Cure53 would like to thank U-Zyn Chua, Arif Khan, Daniel Lo, Asyraf Norafandi, Ben Zumbrunn,and Steven Kearns from the Cake Pte. Ltd. team for their excellent project coordination, support
and assistance, both before and during this assignment.

Cure53, Berlin · 04/27/22

2/2