Valinity Application

CertiK28 Oct 2022Code version: not recorded (see the report)

Audit

CertiK reviewed Valinity (Valinity Application) on 28 Oct 2022: 16 findings, 0 critical; 13 marked fixed, 3 open.

No open critical findings

Open the report Open Valinity’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings16

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	0
Medium	0	4
Low	3	9

LowInsecure bucket configurationOpen

During testing the testers found many bucket configuration issues with the `My Freedom Coin` project. The following problems exist. - Bucket Access Logging Disabled - Bucket Allowing Clear Text (HTTP) Communication - Bucket without Default Encryption Enabled - Bucket without MFA Delete - Bucket without Versioning

LowRoot Account without Hardware MFAOpen

A hardware MFA device generates a six-digit numeric code based upon a time-synchronized one-time password algorithm. The user must type a valid code from the device when prompted during the sign-in process. Each MFA device assigned to a user must be unique; a user cannot type a code from another user's device to be authenticated.

LowSensitive Information Disclosed in MemoryOpen

The mnemonics and password for wallets as well as other sensitive information are still available in memory even after the user logs out of the application. This allows for an attacker with physical access to the user's system to access the memory and steal the session token. The clear text-sensitive information and PII in the memory should be reset after it is used or after the user logs out of the application.