blend.capital

Findings

• medium No Content-Security-Policy
  The site sends no Content-Security-Policy, so an injected script (XSS, compromised dependency) runs with full access to the wallet UI.
• medium Page can be framed (clickjacking)
  Any site can embed this page in a frame, so users can be tricked into clicking wallet-connect or approval buttons.
• low DNSSEC not enabled
  DNS answers for the domain are not signed, so a resolver-level attacker could redirect users to a fake front end.
• low No Referrer-Policy
  Full page URLs (which can carry addresses or tokens) may be sent to third-party sites in the Referer header.
• low No security.txt
  There is no /.well-known/security.txt, so researchers who find a vulnerability have no published way to report it.
• low Third-party scripts without Subresource Integrity
  Scripts are loaded from third-party hosts without integrity hashes, so a compromised CDN or package can inject code.
• info No CAA record
  Any certificate authority may issue certificates for the domain.
• info No Permissions-Policy
  The site does not restrict powerful browser features (camera, microphone, payment, USB) for itself and embedded frames.
• info Third-party scripts
  The homepage loads scripts from 3 third-party origin(s); each one can read and change the wallet UI.

Evidence, exact locations and fixes are in the deep report. How scoring works.

Facts

Hosting

Cloudflare

DNS provider

Cloudflare

DNSSEC

No

HTTPS

Yes

HSTS

Yes (365 days)

CSP

No

Wallet SDKs

None detected

Third-party scripts

3

Scripts scanned

5

security.txt

No

robots.txt

No

Badge

[![Vetted by DappVet](https://dappvet.com/badge/GL2ol0N5.svg)](https://dappvet.com/d/blend.capital)

<a href="https://dappvet.com/d/blend.capital"><img src="https://dappvet.com/badge/GL2ol0N5.svg" alt="Vetted by DappVet" height="20"></a>

Share on X