Allo - Pentest

QuillAudits21 Apr 2025Code version: not recorded (see the report)

Penetration test of off-chain systemsNot counted as an audit report

QuillAudits reviewed Allo - Pentest on 21 Apr 2025: 4 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Allo - Pentest’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	1
Low	0	0	3

MediumInsecure Direct Object ReferenceFixed

An Insecure Direct Object Reference (IDOR) vulnerability has been discovered in the application, which allows an attacker to access unauthorized data by manipulating the unique identifier of a resource. This can occur when the application uses user-supplied data to access or manipulate a resource without proper validation or access controls. In the current scenario, we can change the account id and address with victim’s details and we should be able to view the information.

LowAPI_KEYS leakedFixed

Two production-grade credentials were discovered hard-coded in JavaScript bundles that ship to end-users

LowClickjackingFixed

Clickjacking is a type of attack that tricks a user into clicking on a malicious link or button without their knowledge. This can be done by overlaying an invisible layer over a legitimate link or button on a web page, thus making the user unwittingly click the malicious link or button.

LowNo/Misconfigured SPF RecordFixed

The Sender Policy Framework (SPF) record for the domain is configured with a SoftFail (~all) mechanism instead of a HardFail (-all). This allows unauthorized mail servers to send emails on behalf of the domain, which may increase the risk of email spoofing and phishing attacks. With SoftFail, non-compliant emails are typically marked as spam rather than rejected outright, potentially allowing malicious emails to reach recipients’ inboxes