Browse / MetaMask

MetaMask

See its reports on the map

What gets reported to MetaMask

• Access Control2
• Cross-site Scripting2
• Business Logic2
• Authentication1
• Code Execution1
• Injection and Smuggling1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. total Failure of password protection while extracting seed phrase! increases attack surface area for scammersAuthentication Bypass Using an Alternate Path or Channel · medium
   $3,500131 votes
2. Missing Line Terminator on allowedOrigins enables origin spoofingImproper Access Control - Generic · high
   90 votes
3. MetaMask Browser URL and Transaction Origin Spoofing - Metamask wallet Android & Metamask wallet iOSCross-site Scripting (XSS) - Stored · high
   87 votes
4. Authorization Bypass in Starknet Snap via enableAuthorize parameter leads to unauthorized transaction signingBusiness Logic Errors · medium
   $35086 votes
5. MetaMask Browser (on Android) does not enforce Content-Security-Policy headerCross-site Scripting (XSS) - Reflected · medium
   64 votes
6. Sub-Domain Takeover at http://www.codefi.consensys.net/Improper Access Control - Generic · medium
   $50042 votes
7. Arbitrary file write triggered by deeplink abuse - MetaMask AndroidBusiness Logic Errors · medium
   40 votes
8. CSV Injection at https://assets-paris-demo.codefi.network/Command Injection - Generic · medium
   $50040 votes
9. Bypass parsing of transaction data, users on the phishing site will transfer/approve ERC20 tokens without being alertedImproper Input Validation · low
   $1,00032 votes
10. Public Postman Api Collection Leaks Internal access to https://assets-paris-dev.codefi.network/ Insecure Storage of Sensitive Information · medium
    $50019 votes
11. Possible to spoof Origin in "Connected Sites"User Interface (UI) Misrepresentation of Critical Information · low
    13 votes