Pentest Agent

app.uniswap.org

Public security posture · Completed

Share on X

Security grade

B
Configuration score80/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
1
Medium
3
Low
2
Informational
14 of 20 assessed checks passed

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://app.uniswap.org/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
301 → https://app.uniswap.org/
HSTS is enabledPassed
Browsers are told to use HTTPS for 730 days, including subdomains.
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Legacy TLS versions are refusedPassed
The server refused handshakes offering only TLS 1.0 or TLS 1.1.
TLS 1.0
rejected
TLS 1.1
rejected

HTTP security headers

3 findings
mediumConfirmed

Content Security Policy does not restrict scripts

A policy is set, but it has no script-src or default-src directive, so any injected script will still run. Directives present: frame-ancestors.

Content-Security-Policy
frame-ancestors 'self' https://app.safe.global https://dexscreener.com https://*.dexscreener.com
Recommendation · Add a script-src (or default-src) directive listing the origins the app loads scripts from, e.g. script-src 'self' 'nonce-…' 'strict-dynamic'; object-src 'none'; base-uri 'self'.
Why it matters ↓

CSP limits which scripts can run. For dApps it is the main browser-side defence against an injected script draining connected wallets.

How we check: Reads the Content-Security-Policy header and flags policies that still allow inline or arbitrary-origin scripts.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
infoConfirmed

Permissions-Policy not set

Embedded content may request browser features the site never uses.

Permissions-Policy
(not set)
Recommendation · Add a policy disabling unused features, e.g. Permissions-Policy: camera=(), microphone=(), geolocation=().
Why it matters ↓

Limits what embedded third-party content can access, such as camera, microphone or payment APIs.

How we check: Checks for a Permissions-Policy header restricting powerful browser features.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
infoConfirmed

Referrer-Policy not set

Modern browsers default to a safe policy, but older ones may send full URLs to other sites.

Referrer-Policy
(not set)
Recommendation · Add Referrer-Policy: strict-origin-when-cross-origin.
Why it matters ↓

URLs can contain tokens, wallet addresses or referral codes. A strict policy keeps them from leaking to third parties.

How we check: Reads the Referrer-Policy header and flags policies that leak full URLs to other sites.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
Framing is restrictedPassed
Other sites can't embed this page in a frame.
X-Frame-Options
SAMEORIGIN
CSP frame-ancestors
'self' https://app.safe.global https://dexscreener.com https://*.dexscreener.com
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

2 findings
lowConfirmed

No SPF record

The domain doesn't declare which servers may send mail as it.

MX
(none)
Recommendation · If the domain never sends mail, publish v=spf1 -all.
Why it matters ↓

SPF lists who may send mail as the domain. Crypto projects are frequent targets of impersonation emails.

How we check: Reads the domain's TXT records for an SPF policy and checks it is not permissive.

https://datatracker.ietf.org/doc/html/rfc7208
lowConfirmed

DNSSEC not enabled

DNS answers for this domain are not cryptographically signed.

AD flag
not set
Recommendation · Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
Why it matters ↓

DNSSEC prevents forged DNS answers from sending visitors to a look-alike server.

How we check: Resolves the domain through a validating resolver and checks whether the answer is DNSSEC-authenticated.

https://www.cloudflare.com/dns/dnssec/how-dnssec-works/
CAA records publishedPassed
Certificate issuance is restricted (inherited from uniswap.org).
CAA uniswap.org
0 issue "acm-validations.aws"
CAA uniswap.org
0 issue "amazon.com"
CAA uniswap.org
0 issue "amazonaws.com"
CAA uniswap.org
0 issue "amazontrust.com"
CAA uniswap.org
0 issue "awstrust.com"
CAA uniswap.org
0 issue "comodoca.com"
DMARC enforced (p=reject)Passed
Mail that fails authentication is quarantined or rejected.
_dmarc.uniswap.org
v=DMARC1; p=reject; rua=mailto:contact@uniswap.org

Frontend & disclosure

1 finding
lowPotential · needs review

2 external script origins without integrity checks

Scripts from other domains run with full access to the page. If one of those hosts is compromised, the change reaches your users immediately.

Script origin
https://challenges.cloudflare.com
Script origin
https://cdn.app.uniswap.org
Recommendation · Self-host critical scripts, or pin versioned files with an integrity attribute. Prioritise anything that touches wallet connections.
Why it matters ↓

Compromised third-party scripts are a leading cause of wallet-drainer incidents. SRI makes the browser refuse a script that has been altered.

How we check: Lists scripts loaded from other domains and checks whether they use Subresource Integrity (integrity attribute).

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
security.txt publishedPassed
Researchers have a documented way to report vulnerabilities.
Contact
https://cantina.xyz/bounties/f9df94db-c7b1-434b-bb06-d1360abdd1be

Scope & limitations

Assessment type
Public, non-invasive
Target
app.uniswap.org
Final URL
https://app.uniswap.org/
Resolved addresses
52.85.151.56, 52.85.151.90, 52.85.151.48, 52.85.151.82, 2600:9000:201e:3600:4:38f9:de00:93a1, 2600:9000:201e:9200:4:38f9:de00:93a1, 2600:9000:201e:c600:4:38f9:de00:93a1, 2600:9000:201e:200:4:38f9:de00:93a1, 2600:9000:201e:9800:4:38f9:de00:93a1, 2600:9000:201e:2800:4:38f9:de00:93a1, 2600:9000:201e:ec00:4:38f9:de00:93a1, 2600:9000:201e:a800:4:38f9:de00:93a1
Scanned
Oct 20, 2026, 11:09 UTC
Duration
0.7s
Requests made
14 (budget 60)
Report ID
3srsucr43k
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage and a small set of well-known paths were requested. Other pages and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.

Own app.uniswap.org? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.

app.uniswap.org security report · Grade B · Pentest Agent