Separating tenants securely Security assessment of a white-label NFT marketplace
Partner project by Innowise
Project profile
- CustomerNot named
- PartnerInnowise
- IndustryDigital marketplaces
Challenge
A provider offers a white-label NFT marketplace solution for different brands. The central question of the security assessment was whether the customer environments remain effectively separated from one another, and what weaknesses exist in access to accounts and stored data.
Solution
Testing attack surfaces deliberately
Innowise created test cases for password security, SQL injection and cross-site scripting, among others. The focus was on the isolation of the individual tenants and on the rules for access and data storage.
Assessment areas instead of invented architecture
The assessment covered both application functions and permission rules. The diagram therefore shows the protection boundaries that were tested. It does not assert any particular database partitioning, cloud topology or blockchain implementation.
Assessment boundaries of the white-label platform
Tenant A: Own marketplace → Permissions: Review access; Tenant B: Own marketplace → Permissions: Review access; Tenant C: Own marketplace → Permissions: Review access; Permissions: Review access → Web application: Review attack surfaces; Permissions: Review access → Data storage: Review protection.
Technologies
- Acunetix
- Netsparker
- Selenium
Results
What is documented is that a targeted security assessment was carried out. The documentation states neither a number of remediated vulnerabilities nor an independent security attestation. The results therefore show only the assessment areas that are evidenced.
- Tenant isolation assessed
- Access rules examined
- Storage and web attack surfaces evaluated
Project profile
- CustomerNot named
- PartnerInnowise
- IndustryDigital marketplaces
Technologies
- Acunetix
- Netsparker
- Selenium
