Shentu Chain - DAPP pentest

The OpenTask web application uses JSON Web Tokens (JWT) for authentication. Example of JWT: ```bash eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJoZXhfYWRkciI6ImNmNzgzYzk4YzYzMmRlNjY2YTgzYmE5OWQ5ZDc5YzQ3YjU3YTA0NTYiLCJleHAiOjE3MjkzNzgxNTF9.v1Dlw99NtCMHSKkDdpGZJKDiAQIr3XQttGCPa ``` Upon decoding the payload section of the JWT token: ```json {"hex_addr":"cf783c98c632de666a83ba99d9d79c47b57a0456","exp":1729378151} ``` The `exp` field is the expiration timestamp and it indicates that the JWT token's expiration period is set to 1 month (Saturday, 19 October 2024), which, in general, can be considered excessively long.

In the wallet JavaScript object (`deepwallet`), the `changeKeyRingName` function is responsible for changing the name of the wallet. This function is public, allowing any application to invoke it even when the user is not connected. The user must still accept the change for it to be finalized.

The wallet has the auto-lock feature disabled by default. This feature automatically locks the wallet after a user-selected period of inactivity.

The `VerifySignature` function handles errors with `log.Fatal(err)`. ```go func VerifySignature(pubKey, signature, message []byte) bool { pubK, err := NewSecp256k1PubKey(pubKey) if err != nil { log.Fatal(err) return false } return pubK.VerifySignature(message, signature) } ``` Based on the official documentation, this particular method logs the error message and terminates the application immediately. - https://pkg.go.dev/log#Fatal

On the restaking website, the determination of the user's login address solely depends on the `address` value stored in localStorage. This allows users to spoof any wallet address and access the corresponding dashboard.

HTTP headers are well known and their implementation can make your application more versatile and secure. Modern browsers support many HTTP headers that can improve web application security to protect against clickjacking, cross-site scripting, and other common attacks. The important ones are missing and should be added to the response headers. They are listed below. - `Content-Security-Policy`: Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. - `X-Frame-Options`: X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking. Recommended value "X-Frame-Options: SAMEORIGIN". - `X-Content-Type-Options`: X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared