# Test brief: crypto exchange

Product type: crypto exchange. A platform for buying, selling and holding crypto assets with an order book.
Risk map and evidence: https://howtotestaproduct.com/how-to-test/crypto-exchange/
Printable checklist: https://howtotestaproduct.com/checklists/crypto-exchange/

Run these 9 mandatory tests in this order. A test is done only when its done condition is true on the build you will release.

1. release smoke tests (risks: outage-under-load, store-rejection). Tool class: browser automation. Usually run by: QA engineer.
   Done when: After each deploy, a test account places, fills and cancels a small order on web and mobile, and the balance and order history match.
2. compliance checks (risks: regulatory-penalty, fraud-abuse, store-rejection). Tool class: test management. Usually run by: product manager.
   Done when: Test deposits that match monitoring scenarios raise alerts that reach the review queue, and sign-ups from unlicensed countries are blocked in app and on web.
3. end-to-end functional tests (risks: fraud-abuse, money-loss). Tool class: browser automation. Usually run by: QA engineer.
   Done when: A withdrawal to a new address after a password or phone change triggers a hold and an email the account owner must confirm.
4. penetration testing (risks: money-loss, data-breach). Tool class: proxy. Usually run by: security specialist.
   Done when: An external tester cannot approve a withdrawal from the hot or multisig wallet without the required signers, and cannot read another customer's account from the support console.
5. unit tests (risks: money-loss). Tool class: unit framework. Usually run by: developer.
   Done when: Margin, liquidation and fee rules return the expected result for each test case, and no account flag bypasses liquidation without a recorded approval.
6. data integrity and migration testing (risks: money-loss). Tool class: data validation. Usually run by: QA engineer.
   Done when: After each ledger close and each wallet movement, customer balances per asset in the ledger sum to no more than on-chain and custodial holdings, and no account other than approved market makers carries a negative balance.
7. security scanning (risks: data-breach). Tool class: DAST scanner. Usually run by: security specialist.
   Done when: Each release is scanned and no open high finding remains on withdrawal address changes, API trading keys or stored ID documents.
8. performance and load testing (risks: outage-under-load). Tool class: load generator. Usually run by: developer.
   Done when: With a replay of the busiest price-spike traffic on record, login, order placement and cancel stay within the agreed response target.
9. resilience and failure testing (risks: outage-under-load). Tool class: chaos tool. Usually run by: developer.
   Done when: With one matching engine node or database replica stopped during a load test, orders keep matching and the status page reports degraded service.

Acceptance criteria wording:
A release of the crypto exchange is accepted when a test account places, fills and cancels a small order on web and mobile and the balance and order history match. A withdrawal to a new address after a password or phone change is held until the account owner confirms by email. Customer balances per asset sum to no more than on-chain and custodial holdings, and no account other than approved market makers carries a negative balance.

Report back for each test: pass or fail against its done condition, the build or version tested, and the proof (screenshot, log line or report file).

Licence: CC BY 4.0.