Open Dollar - dApp

QuantstampRepository at commit 07ba83f

Audit

Quantstamp reviewed Open Dollar (Open Dollar - dApp) on 11 Apr 2024: 8 findings, 0 critical; 3 marked fixed, 4 acknowledged, 1 open.

No open critical findings
Open the reportOpen Open Dollar’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low143
LowPotential DoS in Regular ExpressionFixed

Regular expressions work by matching patterns in strings. To do this, they often "backtrack" to try different combinations when multiple paths in the pattern could match. This is usually efficient, but certain combinations of patterns and input strings can cause the regex engine to try an exponential number of combinations, leading to what's called catastrophic backtracking. To mitigate the risk of backtracking and ensure the regular expression does not lead to denial of service, consider the following strategies: 1. **Avoid Nested Quantifiers**: Be cautious with the use of quantifiers like `*`, **`+`**, and **`?`**, especially in nested or adjacent positions, as they can often be the source of backtracking issues. 2. **Possessive Quantifiers**: Use possessive quantifiers (e.g., **`++`**, **`+`**) where appropriate, as they prevent backtracking by discarding matches that don't work immediately. 3. **Atomic Grouping**: Use atomic groups **`(?>...)`** to prevent the regex engine from backtracking into the group once a part of it has matched. 4. **Regex Simplification**: Simplify complex regexes where possible. Break down complex expressions into simpler ones, even if it means processing the string in multiple steps. 5. **Timeouts and Limitations**: Implement execution time limits or timeouts for regex evaluations, especially when processing user-provided inputs. The goal is to write regular expressions in a way that ensures they run efficiently, even with challenging input, thereby preventing potential DoS scenarios. Example of potentially vulnerable code: ``` const handleChange = (e: ChangeEvent<HTMLInputElement>) => { const val = e.target.value if (/^-?\d*[.,]?\d*$/.test(val) && /^\d*(\.\d{0,4})?$/.test(val)) { ```

LowThe wstETH price Displayed Incorrectly to End UsersFixed

The OpenDollar UI shows incorrect price of the 1 wstETH token, it shows with the rate 1:1 when the actual worth of token is higher. This can confuse and mislead end-users of the application.

LowWeak CSP ConfigurationFixed

The CSP is a security measure that helps in detecting and mitigating certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. It's defined via HTTP headers or meta tags in HTML documents and specifies which dynamic resources are allowed to load, thereby preventing attackers from injecting malicious scripts. During our examination of the bot.dev.opendollar.com, app.dev.opendollar.com web application headers and response metadata, we noticed the loose configurations of a Content Security Policy (CSP). This misconfiguration leaves the application vulnerable to XSS attacks, as attackers could potentially inject malicious scripts into the web pages viewed by other users.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (345)

  • https://github.com/open-dollar/od-app/src/model/connectWalletModel.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/model/index.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/public/icons/favicon.ico at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/staking.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Icons/SettingsIcon.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Modals/AuctionsModal.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/AuctionsOperations/index.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Vaults/VaultList.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Icons/SafeIcon.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/services/BalanceUpdater.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Images/ConnectWalletImage.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/ttm-img.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/Lotties/wallet.json at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/splash/discord.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/WalletModal/PendingView.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/magic.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/public/index.html at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/i18n/en.json at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/hooks/useTokenApproval.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/App.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/public/icons/logo512.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/PageHeader.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/ImagePreloader.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/services/safes.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/cypress.json at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/Lotties/register.json at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/FeatherIconWrapper.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/public/od-logo.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/BidLine.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/react-app-env.d.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/connectors/metamask.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/solidity/cache/solidity-files-cache.json at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/hooks/usePrevious.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/caret-up.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Transaction.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/LinkButton.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/blueish-bg.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/splash/partly-cloudy.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/logo192.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/connectors/walletConnectV2.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/curve.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Analytics/DataCard.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/types/auctions.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/cypress/integration/landing-no-safes.test.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/cypress/integration/safe-details.test.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Pagination.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Steps.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/splash/liquid-eth.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/connectors/gnosisSafe.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/StepsContent.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/hooks/useContract.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/services/api.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/AddressLink.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/AuctionsOperations/AuctionsPayment.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/model/connectWalletModel.test.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Images/CreateAccountImage.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/public/icons/apple-touch-icon.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/connectorCards/Card.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/getLibrary.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Confetti/index.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/hooks/useAuctions.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/model/multicallModel.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/package.json at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/boxes.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/BlockedAddress.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Icons/ArrowDown.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/ConnectedWalletInfo.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/connectorCards/CoinbaseWalletCard.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/NavLinks.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Footer.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Modals/ScreenLoader.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/services/ApplicationUpdater.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Vaults/wrapEth/TxConfirmation.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/plus.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/public/od-logo192w.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/claim.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/public/icons/site.webmanifest at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/services/blockchain.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/.github/workflows/document-issue.yml at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/hooks/useBlocksConfirmations.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Vaults/CreateVault.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Icons/Identicon.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/public/robots.txt at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/CustomTooltip.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/abis/erc20_bytes32.json at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/od-vault.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/abis/erc20.json at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/od-logo.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/AuctionsOperations/AuctionsTransactions.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/hooks/index.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/splash/partly-cloudy.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/footer-bg-art.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/stn-img.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/Lotties/vault.json at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/od-colorloop.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/mine.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/model/transactionsModel.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/ErrorBoundary.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Modals/Modal.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/craco.config.js at commit 07ba83f
  • https://github.com/open-dollar/od-app/public/CNAME at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/i18n/index.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/.yarn/releases/yarn-3.2.3.cjs at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Icons/Uniswap.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Splash.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/public/logo512.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/incentive.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/themes/dark.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/setupTests.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/od-logo192w.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/hooks/useSafe.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/arrow.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/public/icons/mstile-150x150.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/connectors/network.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Vaults/VaultHeader.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/od-logo.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/hooks/useDebounce.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Vaults/VaultDetails.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Vaults/ModifyVault.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/.gitignore at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Auctions/AuctionsList.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/hooks/useActiveWeb3React.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/.prettierrc.json at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Web3ReactManager/index.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/serviceWorker.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/connectors/arrow-right.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/hooks/TransactionHooks.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/uniswap-icon.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/flx-logo.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/abis/SimpleStakingContract.json at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/contractsDescription.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/model/settingsModel.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/od-wallet-icon.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/.github/actions/setup_earthly/action.yml at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Vaults/wrapEth/Wrap.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/flx_uni_hai.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/services/abi.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Dropdown.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/i18n/de.json at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/services/checkSanctions.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Loader.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/CookieBanner.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/.dockerignore at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Vaults/Accounts.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Icons/Sheild.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/splash/optimism.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/.github/workflows/document-pr.yml at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/sell-od.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/queries.js at commit 07ba83f
  • https://github.com/open-dollar/od-app/cypress/integration/landing-safes.test.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Analytics/GoogleTagManager.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/NotificationPopup.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/debt.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Modals/ConnectedWalletModal.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Auctions/CollateralAuctions/CollateralAuctionsList.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/AuctionsOperations/Results.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Auctions/CollateralAuctions/CollateralAuctionBlock.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/cypress/support/commands.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/public/icon.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/validations.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/helper.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/CheckBox.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/connectors/metaMask.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/services/TransactionUpdater.test.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/AlertLabel.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/abis/common.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Icons/TransactionSpinner.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/README.md at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/retry.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/model/transactionModel.test.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/Dockerfile at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Deposit/DepositFunds.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/stETH.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Images/OpenSafeImage.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/ConnectWithSelect.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/op-img.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Shared.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Vaults/Stats.js at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/staking.png at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/assets/arrow-up.svg at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/hooks/useQuery.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/BlockBodyContainer.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/graph.js at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/AuctionsFAQ.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/VaultManager.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Icons/LoadingIcon.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/yarn.lock at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/model/auctionModel.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Auctions/index.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/ToastPayload.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/removeDecimals.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/chunkArray.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/utils/wrapEther.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Icons/CopyIcon.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/model/popupsModel.ts at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/containers/Analytics/index.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/.github/workflows/check-reminder.yml at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/Modals/WETHModal.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/components/connectorCards/MetaMaskCard.tsx at commit 07ba83f
  • https://github.com/open-dollar/od-app/src/index.tsx at commit 07ba83f

Part of Open Dollar’s security record

Open Dollar
Audits3 audits by 2 firmsLast audit Apr 2024, by Quantstamp.
Critical findingsNo open critical findingsAcross 3 reports.
Open Open Dollar’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us