Gratipay · Report #117739
limit number of images in statement
Validstatus
mediumseverity
$1bounty
2upvotes
16 Jun 2017disclosed
How it was found
Hello
The use of the images in the statements

There appears to be no limit on how many can be inserted. On my own account "https://gratipay.com/~34534534fsfs/" I placed 100
Gratipay users could unknowingly become part of a DDoS attack against another site.
I would recommend limiting the number of images that can be placed.
Attached is a video of just a traffic counter being triggered by the page load.