Pentest Agent

curve.finance

Public security posture · Completed

Share on X

Security grade

B
Configuration score76/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
2
Medium
1
Low
2
Informational
18 of 23 assessed checks passed · 1 not assessed
Agent summaryExplains the evidence below. It doesn't create findings or change the grade.

Agent summary

If an attacker injects a script into the site, it will run because there is no Content Security Policy to restrict which scripts are trusted. The site is already doing well in several areas, including HTTPS, HSTS, and DNSSEC validation. To further improve security, the site should focus on implementing missing security headers and refining its content security posture.

  1. 01Implement a Content Security Policy to define trusted script sources and prevent injected scripts from running.Content Security Policymedium
  2. 02Add X-Frame-Options and frame-ancestors headers to prevent the site from being loaded inside an invisible frame and overlaid with misleading content.Framing protectionmedium
  3. 03Remove public source maps to prevent exposing the original application source.Public source mapslow
  4. 04Set a Referrer-Policy to control the information sent to other sites when users click on links.Referrer policyinfo
  5. 05Implement a Permissions-Policy to disable unused browser features and prevent embedded content from requesting unnecessary permissions.Permissions policyinfo

meta/llama-3.3-70b-instruct-fp8-fast · Workers AI

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://www.curve.finance/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
301 → https://curve.finance/
HSTS is enabledPassed
Browsers are told to use HTTPS for 365 days, including subdomains.
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Legacy TLS not assessedNot assessed
Our scanning network could not open a raw TLS connection to this host (proxy request failed, cannot connect to the specified address. It looks like you might be trying to connect to a HTTP-based service — consider using fetch instead).
TLS 1.0
unknown
TLS 1.1
unknown

HTTP security headers

4 findings
mediumConfirmed

No framing protection

Any website can load this page inside an invisible frame and overlay it with misleading content.

X-Frame-Options
(not set)
CSP frame-ancestors
(not set)
Recommendation · Add Content-Security-Policy: frame-ancestors 'none' (or 'self'), and X-Frame-Options: DENY for older browsers.
Why it matters ↓

Without framing protection, another site can embed this one invisibly and trick users into clicking — for example approving a transaction.

How we check: Checks for X-Frame-Options or a CSP frame-ancestors directive.

https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
mediumConfirmed

Content Security Policy missing

The browser is not told which script sources to trust, so any injected script will run.

Content-Security-Policy
(not set)
Recommendation · Start with a policy such as default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none', then add only the origins the app needs. Use nonces or hashes instead of 'unsafe-inline'.
Why it matters ↓

CSP limits which scripts can run. For dApps it is the main browser-side defence against an injected script draining connected wallets.

How we check: Reads the Content-Security-Policy header and flags policies that still allow inline or arbitrary-origin scripts.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
infoConfirmed

Permissions-Policy not set

Embedded content may request browser features the site never uses.

Permissions-Policy
(not set)
Recommendation · Add a policy disabling unused features, e.g. Permissions-Policy: camera=(), microphone=(), geolocation=().
Why it matters ↓

Limits what embedded third-party content can access, such as camera, microphone or payment APIs.

How we check: Checks for a Permissions-Policy header restricting powerful browser features.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
infoConfirmed

Referrer-Policy not set

Modern browsers default to a safe policy, but older ones may send full URLs to other sites.

Referrer-Policy
(not set)
Recommendation · Add Referrer-Policy: strict-origin-when-cross-origin.
Why it matters ↓

URLs can contain tokens, wallet addresses or referral codes. A strict policy keeps them from leaking to third parties.

How we check: Reads the Referrer-Policy header and flags policies that leak full URLs to other sites.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

All checks passed
DNSSEC validatedPassed
The resolver authenticated the answer with DNSSEC.
AD flag
set
CAA records publishedPassed
Certificate issuance is restricted.
CAA curve.finance
0 iodef "mailto:security@worldethicaldata.org"
CAA curve.finance
0 issue "amazon.com"
CAA curve.finance
0 issue "amazonaws.com"
CAA curve.finance
0 issue "amazontrust.com"
CAA curve.finance
0 issue "awstrust.com"
CAA curve.finance
0 issue "comodoca.com"
SPF record publishedPassed
Authorised mail senders are declared.
TXT
v=spf1 include:_spf.protonmail.ch -all
DMARC enforced (p=quarantine)Passed
Mail that fails authentication is quarantined or rejected.
_dmarc.curve.finance
v=DMARC1; p=quarantine; rua=mailto:24504e167d6142e9a737487bd4ba8eff@dmarc-reports.cloudflare.net;

Frontend & disclosure

All checks passed
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own domain.
security.txt publishedPassed
Researchers have a documented way to report vulnerabilities.
Contact
mailto:security@curve.finance

Web3 frontend

1 finding
lowConfirmed

3 public source maps

The original application source can be downloaded alongside the minified scripts.

Source map
https://www.curve.finance/assets/chains-CQvwpAmD.js.map
Source map
https://www.curve.finance/assets/ConnectWalletButton-CDLZs6Gm.js.map
Source map
https://www.curve.finance/assets/useWallet-CnesUHNO.js.map
Recommendation · Stop publishing .map files in production, or upload them only to your error-tracking service.
Why it matters ↓

Public source maps reveal the original, unminified application code, which makes logic flaws and hidden endpoints easier to find.

How we check: Follows sourceMappingURL comments in the site's own scripts (up to 3) and checks whether the source map can be downloaded.

https://developer.mozilla.org/en-US/docs/Glossary/Source_map
No known-malicious releases referencedPassed
Checked 8 scripts and the homepage HTML against published malicious wallet-package releases.
No wallet code loaded from public CDNsPassed
Wallet and chain libraries are not fetched from public CDNs at runtime.
All 6 referenced contracts have verified sourcePassed
Every address found in the page code has verified source on Sourcify.
0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48
Verified on Ethereum
0xdAC17F958D2ee523a2206206994597C13D831ec7
Verified on Ethereum
0xcA11bde05977b3631167028862bE2a173976CA11
Verified on Ethereum, Base, Arbitrum One, OP Mainnet, Polygon, BNB Chain
0x6B175474E89094C44Da98b954EedeAC495271d0F
Verified on Ethereum
0x6c3F90f043a72FA612cbac8115EE7e52BDe6E490
Verified on Ethereum
0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599
Verified on Ethereum

Wallet stack detected

No wallet or chain libraries recognised in the inspected code.

Inspected 8 scripts (2,249 KB) that the homepage loads for every visitor, plus the HTML. Lazy-loaded code beyond these may not be covered.

Contracts referenced in page code

Verification status from Sourcify. Green chains link to the block explorer.

Agent trace

36 steps · every action the agent took
Show the full trace ↓
  1. 0.0s▸Public assessment of curve.finance · budget 60 requests
  2. 0.1s✓Resolved curve.finance → 172.66.40.133 (+3 more), all public
  3. 0.2s▸Probing HTTPS, HTTP and legacy TLS
  4. 0.7s✓GET https://curve.finance/ → 200 (landed on https://www.curve.finance/) in 457ms
  5. 0.7s·GET http://curve.finance/ → 301 https://curve.finance/
  6. 0.7s·TLS 1.0 probe not possible from this network
  7. 0.7s·TLS 1.1 probe not possible from this network
  8. 0.7s·Security headers present: strict-transport-security, x-content-type-options
  9. 0.7s·0 cookies set on the homepage
  10. 0.8s▸Reading DNS, security.txt and the page's JavaScript
  11. 0.8s·Homepage references 126 scripts; reading chains-CQvwpAmD.js, ConnectWalletButton-CDLZs6Gm.js, useWallet-CnesUHNO.js, connect-wallet-kHsGuyx2.js
  12. 0.8s·DNS: DNSSEC on · CAA set · SPF set · DMARC quarantine
  13. 0.9s·security.txt found
  14. 1.0s·Following imports: 122 more chunks found; reading chain-validation-BZBkLvB1.js, ethers-BvtADiI6.js, chains-B2LmTn1p.js, default-crypto-J2JYP1Xc.js
  15. 1.2s·chains-CQvwpAmD.js (31 KB)
  16. 1.4s!Source map is public: chains-CQvwpAmD.js.map
  17. 1.4s·ConnectWalletButton-CDLZs6Gm.js (1 KB)
  18. 1.6s!Source map is public: ConnectWalletButton-CDLZs6Gm.js.map
  19. 1.6s·useWallet-CnesUHNO.js (262 KB)
  20. 2.0s!Source map is public: useWallet-CnesUHNO.js.map
  21. 2.0s·connect-wallet-kHsGuyx2.js (1.9 MB)
  22. 2.0s·chain-validation-BZBkLvB1.js (1 KB)
  23. 2.0s·ethers-BvtADiI6.js (1 KB)
  24. 2.0s·chains-B2LmTn1p.js (1 KB)
  25. 2.0s·default-crypto-J2JYP1Xc.js (1 KB)
  26. 2.0s·No wallet or chain libraries recognised
  27. 2.0s▸Found 6 contract addresses in page code; checking Sourcify on 6 chains
  28. 3.7s✓0xA0b8…eB48 verified on Ethereum
  29. 3.7s✓0xdAC1…1ec7 verified on Ethereum
  30. 3.7s✓0xcA11…CA11 verified on Ethereum, Base, Arbitrum One +3
  31. 3.7s✓0x6B17…1d0F verified on Ethereum
  32. 3.7s✓0x6c3F…E490 verified on Ethereum
  33. 3.7s✓0x2260…C599 verified on Ethereum
  34. 3.8s✓Graded B (76/100) · 0 high, 2 medium, 1 low · 27 requests to the target
  35. 3.9s◆Writing summary with meta/llama-3.3-70b-instruct-fp8-fast
  36. 11.8s◆Summary ready · 5 prioritized fixes

Scope & limitations

Assessment type
Public, non-invasive
Target
curve.finance
Final URL
https://www.curve.finance/
Resolved addresses
172.66.40.133, 172.66.43.123, 2606:4700:3108::ac42:2885, 2606:4700:3108::ac42:2b7b
Scanned
Oct 20, 2026, 12:02 UTC
Duration
3.8s
Requests made
27 (budget 60)
Report ID
56jakhurrv
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage, up to 8 of the scripts it loads, and a few well-known paths were requested. Other pages, lazy-loaded code and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.
  • 1 check could not be completed and was excluded from the score: Legacy TLS.

Own curve.finance? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.