octrafi.lat

PremiumPublic security posture · Completed

Share on X
$OCTOctrafiRobinhood ChainPonsMC $11.2k at scan
0xF4a3bfb13056384e22bC459257de7BE18638fcb4
✓ Confirmed: @octrafi posted this contract addressgmgnDexScreener

This report grades the token's website configuration, not the token contract, liquidity or team.

Security grade

C
Configuration score72/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
2
Medium
2
Low
2
Informational
18 of 24 assessed checks passed
Agent summaryExplains the evidence below. It doesn't create findings or change the grade.

Agent summary

An attacker could inject malicious JavaScript that runs in users' browsers, potentially capturing wallet connection attempts or personal data. The site already enforces HTTPS with HSTS, disables legacy TLS, blocks framing, and avoids third‑party scripts. The remaining fixes focus on hardening email authentication, DNS integrity, and confirming the safety of referenced smart contracts.

  1. 01Define and deploy a Content Security Policy (e.g., default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none') and use nonces or hashes for any needed inline scripts.Content Security Policymedium
  2. 02Publish a DMARC TXT record (e.g., v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain) and monitor reports before moving to p=reject.DMARC policymedium
  3. 03Add an SPF TXT record, such as 'v=spf1 -all' if the domain does not send mail, to specify authorized senders.SPF recordlow
  4. 04Enable DNSSEC with your DNS provider and publish the corresponding DS record at your registrar.DNSSEClow
  5. 05Verify the source code of all referenced smart contract addresses on Sourcify or the appropriate block explorer and publish the verified source.Referenced contract verificationinfo

openai/gpt-oss-120b · Workers AI

Website & claims

What the site says, checked against data
Screenshot of octrafi.lat at scan time
octrafi.lat · captured at scan time
Page title
Octrafi
Domain registered
Unavailable
Registrar
–
Contract address on site
0x774b0e022477e83108530a975e9edf26cc4301bf
Links on site
None found
✗ Doesn't match

Contract address shown on the website

The site shows 0x774b0e022477e83108530a975e9edf26cc4301bf, not 0xF4a3bfb13056384e22bC459257de7BE18638fcb4.

Claims are quoted verbatim from the page. “Matches” and “Doesn't match” come from on-chain data, the token's metadata or public domain records. Anything we can't check against data is marked “Can't verify”, which is not the same as false.

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://octrafi.lat/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
308 → https://octrafi.lat/
HSTS is enabledPassed
Browsers are told to use HTTPS for 730 days.
Strict-Transport-Security
max-age=63072000
Legacy TLS versions are refusedPassed
The server refused handshakes offering only TLS 1.0 or TLS 1.1.
TLS 1.0
rejected
TLS 1.1
rejected

HTTP security headers

1 finding
mediumConfirmed

Content Security Policy missing

The browser is not told which script sources to trust, so any injected script will run.

Content-Security-Policy
(not set)
Recommendation · Start with a policy such as default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none', then add only the origins the app needs. Use nonces or hashes instead of 'unsafe-inline'.
Why it matters ↓

CSP limits which scripts can run. For dApps it is the main browser-side defence against an injected script draining connected wallets.

How we check: Reads the Content-Security-Policy header and flags policies that still allow inline or arbitrary-origin scripts.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
Framing is restrictedPassed
Other sites can't embed this page in a frame.
X-Frame-Options
DENY
MIME sniffing disabledPassed
Browsers will respect declared content types.
X-Content-Type-Options
nosniff
Referrer-Policy is setPassed
Policy: strict-origin-when-cross-origin.
Referrer-Policy
strict-origin-when-cross-origin
Permissions-Policy is setPassed
Access to powerful browser features is restricted.
Permissions-Policy
camera=(), microphone=(), geolocation=()
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

3 findings
mediumConfirmed

No DMARC policy

Receiving mail servers aren't told what to do with mail that spoofs this domain.

Lookup
_dmarc.octrafi.lat
Recommendation · Publish _dmarc TXT v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain and move to p=reject once reports look clean.
Why it matters ↓

DMARC tells receiving mail servers to reject mail that fails authentication — the main defence against spoofed announcements from your domain.

How we check: Reads the _dmarc TXT record for the domain or its organizational domain and checks the policy.

https://dmarc.org/overview/
lowConfirmed

No SPF record

The domain doesn't declare which servers may send mail as it.

MX
(none)
Recommendation · If the domain never sends mail, publish v=spf1 -all.
Why it matters ↓

SPF lists who may send mail as the domain. Crypto projects are frequent targets of impersonation emails.

How we check: Reads the domain's TXT records for an SPF policy and checks it is not permissive.

https://datatracker.ietf.org/doc/html/rfc7208
lowConfirmed

DNSSEC not enabled

DNS answers for this domain are not cryptographically signed.

AD flag
not set
Recommendation · Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
Why it matters ↓

DNSSEC prevents forged DNS answers from sending visitors to a look-alike server.

How we check: Resolves the domain through a validating resolver and checks whether the answer is DNSSEC-authenticated.

https://www.cloudflare.com/dns/dnssec/how-dnssec-works/
CAA records publishedPassed
Certificate issuance is restricted.
CAA octrafi.lat
0 issue "letsencrypt.org"
CAA octrafi.lat
0 issue "pki.goog"
CAA octrafi.lat
0 issue "sectigo.com"

Frontend & disclosure

1 finding
infoConfirmed

No security.txt

There is no published channel for reporting vulnerabilities.

https://octrafi.lat/.well-known/security.txt
HTTP 404
Recommendation · Publish /.well-known/security.txt with Contact and Expires fields (see securitytxt.org).
Why it matters ↓

Gives researchers a clear way to report vulnerabilities privately instead of disclosing them publicly.

How we check: Requests /.well-known/security.txt and checks it contains a Contact field and has not expired.

https://securitytxt.org/
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own domain.

Web3 frontend

1 finding
infoPotential · needs review

14 of 15 referenced addresses without verified source on Sourcify

These addresses appear in the page code but have no verified source on Sourcify for Ethereum, Base, Arbitrum One, OP Mainnet, Polygon, BNB Chain. They may be wallets rather than contracts, live on another chain, or be verified elsewhere, such as Etherscan.

Unverified address
0xe5e702641ea86f4ae6cc3cdaed2b886f976be044
Unverified address
0x5fc5360d0400a0fd4f2af552add042d716f1d168
Unverified address
0xd0601ce157db5bdc3162bbac2a2c8af5320d9eec
Unverified address
0x2e0847e8910a9732eb3fb1bb4b70a580adad4fe3
Unverified address
0xaf3d76f1834a1d425780943c99ea8a608f8a93f9
Unverified address
0xc0d6457c16cc70d6790dd43521c899c87ce02f35
Recommendation · Verify the source of every contract users interact with on Sourcify and the relevant block explorer.
Why it matters ↓

Users should be able to read the code they're asked to interact with. Unverified addresses aren't necessarily unsafe, so this is informational only.

How we check: Extracts EVM addresses referenced in the page code (up to 6) and checks Sourcify for verified source on Ethereum, Base, Arbitrum, OP Mainnet, Polygon and BNB Chain.

https://docs.sourcify.dev/
No known-malicious releases referencedPassed
Checked 14 scripts and the homepage HTML against published malicious wallet-package releases.
Wallet stack detected
viem
No wallet code loaded from public CDNsPassed
Wallet and chain libraries are not fetched from public CDNs at runtime.
No source maps referencedPassed
None of the 14 scripts and the homepage HTML reference a source map.

Wallet stack detected

  • viem

Inspected 14 scripts (1,331 KB) that the homepage loads for every visitor, plus the HTML. Lazy-loaded code beyond these may not be covered.

Contracts referenced in page code

  • 0xe5e7…e044no Sourcify match
  • 0x8876…0904EthereumBaseArbitrum One
  • 0x5fc5…d168no Sourcify match
  • 0xd060…9eecno Sourcify match
  • 0x2e08…4fe3no Sourcify match
  • 0xaf3d…93f9no Sourcify match
  • 0xc0d6…2f35no Sourcify match
  • 0xea00…2be6no Sourcify match
  • 0x69f1…e1adno Sourcify match
  • 0x72be…533cno Sourcify match
  • 0x01e6…3111no Sourcify match
  • 0x0bd7…ad73no Sourcify match
  • 0x1016…87b0no Sourcify match
  • 0x52e6…71cano Sourcify match
  • 0x4a0e…5eeano Sourcify match

Verification status from Sourcify. Green chains link to the block explorer.

Agent trace

50 steps · every action the agent took
Show the full trace ↓
  1. 0.0s▸Premium assessment of octrafi.lat · budget 100 requests
  2. 0.0s✓Resolved octrafi.lat → 216.150.1.129 (+1 more), all public
  3. 0.1s▸Probing HTTPS, HTTP and legacy TLS
  4. 0.2s✓GET https://octrafi.lat/ → 200 in 158ms
  5. 0.2s·GET http://octrafi.lat/ → 308 https://octrafi.lat/
  6. 0.2s✓TLS 1.0 handshake refused
  7. 0.2s✓TLS 1.1 handshake refused
  8. 0.2s·Security headers present: strict-transport-security, x-frame-options, x-content-type-options, referrer-policy, permissions-policy
  9. 0.2s·0 cookies set on the homepage
  10. 0.3s▸Reading DNS, security.txt and the page's JavaScript
  11. 0.3s·Homepage references 1 script; reading index-6XnuhwKA.js
  12. 0.3s·security.txt not found (HTTP 404)
  13. 0.3s·DNS: DNSSEC off · CAA set · SPF none · DMARC none
  14. 0.4s·Following imports: 13 more chunks found; reading chain-CW5fPAXY.js, stocks-g6P4vij-.js, coins-BQa73sNi.js, presets-B-PiB4K2.js, quote-BB9sZx9n.js, build-DR71b9rK.js, holdings-Dd3wfCpX.js, receipt-DuYVLBW9.js, Shared-ClMM6Bne.js, Me-CpnnoNYR
  15. 1.0s·index-6XnuhwKA.js (899 KB): viem
  16. 1.0s·chain-CW5fPAXY.js (1 KB)
  17. 1.0s·stocks-g6P4vij-.js (103 KB)
  18. 1.0s·coins-BQa73sNi.js (280 KB)
  19. 1.0s·presets-B-PiB4K2.js (2 KB)
  20. 1.0s·quote-BB9sZx9n.js (9 KB)
  21. 1.0s·build-DR71b9rK.js (26 KB)
  22. 1.0s·holdings-Dd3wfCpX.js (2 KB)
  23. 1.0s·receipt-DuYVLBW9.js (1 KB)
  24. 1.0s·Shared-ClMM6Bne.js (1 KB)
  25. 1.0s·Me-CpnnoNYR.js (2 KB)
  26. 1.0s·Docs-CzDvz8eb.js (5 KB)
  27. 1.0s·Kit-BE0nP-Ej.js (2 KB)
  28. 1.0s·NotFound-CCJYLRYb.js (1 KB)
  29. 1.0s·Wallet stack: viem
  30. 1.0s▸Found 15 contract addresses in page code; checking Sourcify on 6 chains
  31. 4.4s·0xe5e7…e044: no Sourcify match
  32. 4.4s✓0x8876…0904 verified on Ethereum, Base, Arbitrum One
  33. 4.4s·0x5fc5…d168: no Sourcify match
  34. 4.4s·0xd060…9eec: no Sourcify match
  35. 4.4s·0x2e08…4fe3: no Sourcify match
  36. 4.4s·0xaf3d…93f9: no Sourcify match
  37. 4.4s·0xc0d6…2f35: no Sourcify match
  38. 4.4s·0xea00…2be6: no Sourcify match
  39. 4.4s·0x69f1…e1ad: no Sourcify match
  40. 4.4s·0x72be…533c: no Sourcify match
  41. 4.4s·0x01e6…3111: no Sourcify match
  42. 4.4s·0x0bd7…ad73: no Sourcify match
  43. 4.4s·0x1016…87b0: no Sourcify match
  44. 4.4s·0x52e6…71ca: no Sourcify match
  45. 4.4s·0x4a0e…5eea: no Sourcify match
  46. 4.5s✓Graded C (72/100) · 0 high, 2 medium, 2 low · 26 requests to the target
  47. 24.4s✓Rendered the homepage in a browser and saved a screenshot: "Octrafi"
  48. 24.5s◆Writing summary with openai/gpt-oss-120b and checking the site's claims
  49. 31.6s◆Checked 1 claim: 0 match, 1 don't match, 0 can't be verified
  50. 32.3s◆Summary ready · 5 prioritized fixes

Scope & limitations

Assessment type
Premium, public, non-invasive
Payment
Complimentary
Target
octrafi.lat
Final URL
https://octrafi.lat/
Resolved addresses
216.150.1.129, 216.150.16.193
Scanned
Oct 21, 2026, 06:13 UTC
Duration
4.5s
Requests made
26 (budget 100)
Report ID
ecyg7g9ysc
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage, up to 8 of the scripts it loads, and a few well-known paths were requested. Other pages, lazy-loaded code and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.

Own octrafi.lat? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.