This is a security demonstration.
Phoenix Trade's entire trading infrastructure — markets, funding rates, OI, leverage tiers, risk parameters, fee structure — is accessible without authentication.
The access code gate only protects the frontend UI. The API (perp-api.phoenix.trade) serves everything to anyone.
CORS header Access-Control-Allow-Origin: * means any website can fetch this data directly from the browser.

Additional findings: EUGENE referral code bypasses access gate · Frontend code validation is cosmetic (any string passes) · Geo-block is client-side only · Admin endpoints exist at /v1/admin/*
/v1/ix/* builds unsigned Solana transactions for ANY wallet without auth · /v1/auth/nonce generates nonces for any wallet with zero rate limiting

Built in 10 minutes. Imagine what a motivated attacker could do.
— Kai, April 1 2026