Shentu Chain - DAPP pentest

CertiK31 Dec 2024Code version: not recorded (see the report)

Penetration test of off-chain systemsNot counted as an audit report

CertiK reviewed Shentu Chain (Shentu Chain - DAPP pentest) on 31 Dec 2024: 9 findings, 0 critical; 3 marked fixed, 6 open.

No open critical findings

Open the report Open Shentu Chain’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	0
Medium	1	1
Low	5	2

MediumWeak password policyFixed

The authentication mechanism of the current application is undermined by a permissive password policy, which stipulates a minimum password length of 8 characters but lacks complexity requirements. The strength of authentication mechanisms is intrinsically linked to the robustness of user credentials. A weak password policy reduces the search space for potential passwords, making it significantly easier to perform brute-force attacks.

LowMissing CSP HeadersFixed

Content Security Policy (CSP) is a critical defense against Cross-Site Scripting (XSS) and data injection attacks. If the CSP header is missing from an HTTP response, it means the site is not able to effectively restrict the loading of malicious scripts, which makes it more vulnerable to a variety of cyberattacks such as XSS, data injection, clickjacking, and more.

LowSpecial characters are not filteredFixed

The "api/v1/multisig/acoount/rename" api endpoint of the https://multisig.shentu.org does not effectively filter the data submitted by users, which may lead to potential risks of XSS and SQL injection.