Pentest Agent

app.uniswap.org

Public security posture · Completed

Share on X

Security grade

B
Configuration score80/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
1
Medium
3
Low
3
Informational
17 of 24 assessed checks passed
Agent summaryExplains the evidence below. It doesn't create findings or change the grade.

Agent summary

If an attacker injects a script into the site, it could run with full access to the page, potentially affecting wallet users. The site is already doing well in terms of HTTPS and TLS configuration, as well as protecting against framing and MIME sniffing. To further improve security, the site should focus on restricting scripts and verifying contract sources.

  1. 01Add a script-src directive to the Content Security Policy to restrict scripts from running on the site.Content Security Policymedium
  2. 02Self-host critical scripts or pin versioned files with an integrity attribute, prioritizing anything that touches wallet connections.Third-party script integritylow
  3. 03Verify the source of every contract users interact with on Sourcify and the relevant block explorer.Referenced contract verificationinfo
  4. 04Enable DNSSEC at the DNS provider and publish the DS record at the registrar.DNSSEClow
  5. 05Publish an SPF record, such as v=spf1 -all, if the domain never sends mail.SPF recordlow

meta/llama-3.3-70b-instruct-fp8-fast · Workers AI

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://app.uniswap.org/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
301 → https://app.uniswap.org/
HSTS is enabledPassed
Browsers are told to use HTTPS for 730 days, including subdomains.
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Legacy TLS versions are refusedPassed
The server refused handshakes offering only TLS 1.0 or TLS 1.1.
TLS 1.0
rejected
TLS 1.1
rejected

HTTP security headers

3 findings
mediumConfirmed

Content Security Policy does not restrict scripts

A policy is set, but it has no script-src or default-src directive, so any injected script will still run. Directives present: frame-ancestors.

Content-Security-Policy
frame-ancestors 'self' https://app.safe.global https://dexscreener.com https://*.dexscreener.com
Recommendation · Add a script-src (or default-src) directive listing the origins the app loads scripts from, e.g. script-src 'self' 'nonce-…' 'strict-dynamic'; object-src 'none'; base-uri 'self'.
Why it matters ↓

CSP limits which scripts can run. For dApps it is the main browser-side defence against an injected script draining connected wallets.

How we check: Reads the Content-Security-Policy header and flags policies that still allow inline or arbitrary-origin scripts.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
infoConfirmed

Permissions-Policy not set

Embedded content may request browser features the site never uses.

Permissions-Policy
(not set)
Recommendation · Add a policy disabling unused features, e.g. Permissions-Policy: camera=(), microphone=(), geolocation=().
Why it matters ↓

Limits what embedded third-party content can access, such as camera, microphone or payment APIs.

How we check: Checks for a Permissions-Policy header restricting powerful browser features.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
infoConfirmed

Referrer-Policy not set

Modern browsers default to a safe policy, but older ones may send full URLs to other sites.

Referrer-Policy
(not set)
Recommendation · Add Referrer-Policy: strict-origin-when-cross-origin.
Why it matters ↓

URLs can contain tokens, wallet addresses or referral codes. A strict policy keeps them from leaking to third parties.

How we check: Reads the Referrer-Policy header and flags policies that leak full URLs to other sites.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
Framing is restrictedPassed
Other sites can't embed this page in a frame.
X-Frame-Options
SAMEORIGIN
CSP frame-ancestors
'self' https://app.safe.global https://dexscreener.com https://*.dexscreener.com
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

2 findings
lowConfirmed

No SPF record

The domain doesn't declare which servers may send mail as it.

MX
(none)
Recommendation · If the domain never sends mail, publish v=spf1 -all.
Why it matters ↓

SPF lists who may send mail as the domain. Crypto projects are frequent targets of impersonation emails.

How we check: Reads the domain's TXT records for an SPF policy and checks it is not permissive.

https://datatracker.ietf.org/doc/html/rfc7208
lowConfirmed

DNSSEC not enabled

DNS answers for this domain are not cryptographically signed.

AD flag
not set
Recommendation · Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
Why it matters ↓

DNSSEC prevents forged DNS answers from sending visitors to a look-alike server.

How we check: Resolves the domain through a validating resolver and checks whether the answer is DNSSEC-authenticated.

https://www.cloudflare.com/dns/dnssec/how-dnssec-works/
CAA records publishedPassed
Certificate issuance is restricted (inherited from uniswap.org).
CAA uniswap.org
0 issue "acm-validations.aws"
CAA uniswap.org
0 issue "amazon.com"
CAA uniswap.org
0 issue "amazonaws.com"
CAA uniswap.org
0 issue "amazontrust.com"
CAA uniswap.org
0 issue "awstrust.com"
CAA uniswap.org
0 issue "comodoca.com"
DMARC enforced (p=reject)Passed
Mail that fails authentication is quarantined or rejected.
_dmarc.uniswap.org
v=DMARC1; p=reject; rua=mailto:contact@uniswap.org

Frontend & disclosure

1 finding
lowPotential · needs review

1 external script origin without integrity checks

Scripts from other domains run with full access to the page. If one of those hosts is compromised, the change reaches your users immediately.

Script origin
https://challenges.cloudflare.com
Recommendation · Self-host critical scripts, or pin versioned files with an integrity attribute. Prioritise anything that touches wallet connections.
Why it matters ↓

Compromised third-party scripts are a leading cause of wallet-drainer incidents. SRI makes the browser refuse a script that has been altered.

How we check: Lists scripts loaded from other domains and checks whether they use Subresource Integrity (integrity attribute).

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
security.txt publishedPassed
Researchers have a documented way to report vulnerabilities.
Contact
https://cantina.xyz/bounties/f9df94db-c7b1-434b-bb06-d1360abdd1be

Web3 frontend

1 finding
infoPotential · needs review

1 of 6 referenced addresses without verified source on Sourcify

These addresses appear in the page code but have no verified source on Sourcify for Ethereum, Base, Arbitrum One, OP Mainnet, Polygon, BNB Chain. They may be wallets rather than contracts, live on another chain, or be verified elsewhere, such as Etherscan.

Unverified address
0x471EcE3750Da237f93B8E339c536989b8978a438
Recommendation · Verify the source of every contract users interact with on Sourcify and the relevant block explorer.
Why it matters ↓

Users should be able to read the code they're asked to interact with. Unverified addresses aren't necessarily unsafe, so this is informational only.

How we check: Extracts EVM addresses referenced in the page code (up to 6) and checks Sourcify for verified source on Ethereum, Base, Arbitrum, OP Mainnet, Polygon and BNB Chain.

https://docs.sourcify.dev/
No known-malicious releases referencedPassed
Checked 8 scripts and the homepage HTML against published malicious wallet-package releases.
Wallet stack detected
WalletConnect, Privy
No wallet code loaded from public CDNsPassed
Wallet and chain libraries are not fetched from public CDNs at runtime.
No source maps referencedPassed
None of the 8 scripts and the homepage HTML reference a source map.

Wallet stack detected

  • WalletConnect
  • Privy

Inspected 8 scripts (138 KB) that the homepage loads for every visitor, plus the HTML. Lazy-loaded code beyond these may not be covered.

Contracts referenced in page code

Verification status from Sourcify. Green chains link to the block explorer.

Scope & limitations

Assessment type
Public, non-invasive
Target
app.uniswap.org
Final URL
https://app.uniswap.org/
Resolved addresses
99.84.41.74, 99.84.41.111, 99.84.41.34, 99.84.41.48, 2600:9000:2120:2a00:4:38f9:de00:93a1, 2600:9000:2120:f000:4:38f9:de00:93a1, 2600:9000:2120:ac00:4:38f9:de00:93a1, 2600:9000:2120:200:4:38f9:de00:93a1, 2600:9000:2120:5e00:4:38f9:de00:93a1, 2600:9000:2120:5000:4:38f9:de00:93a1, 2600:9000:2120:fe00:4:38f9:de00:93a1, 2600:9000:2120:f400:4:38f9:de00:93a1
Scanned
Oct 20, 2026, 11:38 UTC
Duration
3.3s
Requests made
24 (budget 60)
Report ID
e6f6cey3vt
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage, up to 8 of the scripts it loads, and a few well-known paths were requested. Other pages, lazy-loaded code and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.

Own app.uniswap.org? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.

app.uniswap.org security report · Grade B · Pentest Agent