Immunefi Audit Competitions

Zano Trade | IOP

Reports by Severity

Critical

47728 - [W&A - Critical] Server-Side Request Forgery (SSRF) Vulnerability in Next.js _app.tsx component
47740 - [W&A - Critical] Server-Side Request Forgery (SSRF) in ./src/pages/_app.tsx via the Host header
48436 - [W&A - Critical] Dos is possible through the order creation api

Insight

Reports by Type

Websites & Apps

47728 - [W&A - Critical] Server-Side Request Forgery (SSRF) Vulnerability in Next.js _app.tsx component
47725 - [W&A - Insight] Non-Expiring Tokens and CSRF Exposure
47729 - [W&A - Insight] Insecure Token Storage in SessionStorage
47731 - [W&A - Insight] Offer Listings N+1 Query Performance Vulnerability
47740 - [W&A - Critical] Server-Side Request Forgery (SSRF) in ./src/pages/_app.tsx via the Host header
47741 - [W&A - Insight] Missing JWT_SECRET in Env Allows Token Forgery via Empty Secret
48436 - [W&A - Critical] Dos is possible through the order creation api