How a Full-Stack Audit Uncovered 14 Critical Issues in a Live Presale Dashboard Before Public Launch
Written by Erik T., Backend Engineer at Codanum
The Context
A custom TokenLite-based presale dashboard was about to open its doors to real money, and nobody had checked whether the doors actually locked. The platform tracked a multi-tier token offering off-chain through PHP and MySQL, with tokens slated for manual distribution after the sale. With significant capital about to flow through it, the founders wanted certainty before launch, not after.
The Challenge
The dashboard featured a complex 20-tier pricing engine, a multi-level referral bonus structure, and admin controls for stage switching and price management, all built on a legacy PHP codebase with jQuery-driven frontends. No formal code review or security audit had ever been performed. The referral tracking logic was suspected of miscalculating bonuses, and the admin panel lacked proper access controls, creating a significant financial and reputational risk if exploited.
14
Issues Found
5 Days
Delivery
The Solution
A comprehensive full-stack audit was conducted across every layer: frontend JavaScript logic, backend PHP controllers, MySQL schema integrity, and the complete presale transaction flow. Every admin endpoint was mapped for authorisation gaps, the 20-tier pricing engine was stress-tested against edge cases, referral tree calculations were validated against expected payouts, and targeted penetration testing covered payment handling routes and session management.
The Impact
The audit identified 14 critical issues: 3 privilege escalation vulnerabilities in the admin panel, 4 referral calculation logic errors that would have resulted in incorrect bonus distributions, and 7 frontend validation bypasses that could allow manipulated purchase amounts. A remediation report with severity rankings and fix recommendations was delivered within 5 business days, giving the client time to patch all issues before their public launch window.
"Codanum's audit was incredibly thorough. They found issues our own developers had missed for months, including admin panel vulnerabilities that could have been catastrophic. The detailed report gave us a clear roadmap to fix everything before going live."
