85GRADE B
app.avalonfinance.xyz
https://app.avalonfinance.xyz
dApp frontend · scanned 6 h ago
Findings
- medium Content-Security-Policy does not restrict scriptsThe Content-Security-Policy has no script-src or default-src, so it does not limit which scripts can run.
- low DNSSEC not enabledDNS answers for the domain are not signed, so a resolver-level attacker could redirect users to a fake front end.
- low No Referrer-PolicyFull page URLs (which can carry addresses or tokens) may be sent to third-party sites in the Referer header.
- low No security.txtThere is no /.well-known/security.txt, so researchers who find a vulnerability have no published way to report it.
- info No CAA recordAny certificate authority may issue certificates for the domain.
- info No Permissions-PolicyThe site does not restrict powerful browser features (camera, microphone, payment, USB) for itself and embedded frames.
- info Third-party scriptsThe homepage loads scripts from 1 third-party origin(s); each one can read and change the wallet UI.
Evidence, exact locations and fixes are in the deep report. How scoring works.
Scan notes
JavaScript: scanned at most 6 of 28 scripts (budget: 6 files and the per-scan request cap).
Script https://app.avalonfinance.xyz/_next/static/chunks/6890-45f184c55dfdfa38.js truncated at 200 KB.
JavaScript scan stopped at 600 KB.
Facts
- Hosting
- Vercel
- DNS provider
- Cloudflare
- DNSSEC
- No
- HTTPS
- Yes
- HSTS
- Yes (730 days)
- CSP
- Yes
- Wallet SDKs
- WalletConnect, RainbowKit
- Third-party scripts
- 1
- Scripts scanned
- 6
- security.txt
- No
- robots.txt
- No
Badge
[](https://dappvet.com/d/app.avalonfinance.xyz)
<a href="https://dappvet.com/d/app.avalonfinance.xyz"><img src="https://dappvet.com/badge/393SDjpz.svg" alt="Vetted by DappVet" height="20"></a>