themoths.art

PremiumPublic security posture · Completed

Share on X
$MOTHSThemothsRobinhood ChainPonsMC $13.2k at scan
0x93DE2637e373233CF6cAf140d1f1708F9598E53F
✓ Confirmed: the project's website lists this contract addressgmgnDexScreener

This report grades the token's website configuration, not the token contract, liquidity or team.

Security grade

D
Configuration score58/100

Grades reflect only the externally visible controls listed below. A good grade does not prove the application is secure. How grades work

0
High
3
Medium
3
Low
4
Informational
14 of 24 assessed checks passed
Agent summaryExplains the evidence below. It doesn't create findings or change the grade.

Agent summary

Without a Content Security Policy, any injected script could run in visitors' browsers, allowing attackers to steal data or alter the site’s behavior. The site already enforces HTTPS with HSTS, rejects legacy TLS, and avoids third‑party scripts or mixed content. Remaining work focuses on adding missing security headers, hardening DNS policies, and confirming the legitimacy of referenced smart contracts.

  1. 01Define and send a strict Content‑Security‑Policy header (e.g., default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none') and use nonces or hashes for any needed inline scripts.Content Security Policymedium
  2. 02Add X‑Frame‑Options: DENY and/or CSP frame-ancestors 'none' to prevent the site from being embedded in other pages.Framing protectionmedium
  3. 03Publish a DMARC TXT record (e.g., v=DMARC1; p=quarantine; rua=mailto:dmarc@themoths.art) and monitor reports before moving to p=reject.DMARC policymedium
  4. 04Include the X‑Content‑Type‑Options: nosniff header on all responses to stop browsers from MIME‑sniffing.MIME type sniffinglow
  5. 05Verify the source code of each referenced contract address on Sourcify or the appropriate block explorer and publish the verified source.Referenced contract verificationinfo

openai/gpt-oss-120b · Workers AI

TLS & transport

All checks passed
HTTPS works with a trusted certificatePassed
The homepage loaded over HTTPS and the certificate was accepted.
Final URL
https://themoths.art/
Status
200
HTTP redirects to HTTPSPassed
The unencrypted homepage immediately redirects to HTTPS.
Redirect
308 → https://themoths.art/
HSTS is enabledPassed
Browsers are told to use HTTPS for 730 days.
Strict-Transport-Security
max-age=63072000
Legacy TLS versions are refusedPassed
The server refused handshakes offering only TLS 1.0 or TLS 1.1.
TLS 1.0
rejected
TLS 1.1
rejected

HTTP security headers

5 findings
mediumConfirmed

No framing protection

Any website can load this page inside an invisible frame and overlay it with misleading content.

X-Frame-Options
(not set)
CSP frame-ancestors
(not set)
Recommendation · Add Content-Security-Policy: frame-ancestors 'none' (or 'self'), and X-Frame-Options: DENY for older browsers.
Why it matters ↓

Without framing protection, another site can embed this one invisibly and trick users into clicking — for example approving a transaction.

How we check: Checks for X-Frame-Options or a CSP frame-ancestors directive.

https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
mediumConfirmed

Content Security Policy missing

The browser is not told which script sources to trust, so any injected script will run.

Content-Security-Policy
(not set)
Recommendation · Start with a policy such as default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none', then add only the origins the app needs. Use nonces or hashes instead of 'unsafe-inline'.
Why it matters ↓

CSP limits which scripts can run. For dApps it is the main browser-side defence against an injected script draining connected wallets.

How we check: Reads the Content-Security-Policy header and flags policies that still allow inline or arbitrary-origin scripts.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
lowConfirmed

X-Content-Type-Options missing

Browsers may guess content types, which can turn a harmless-looking file into executable script.

X-Content-Type-Options
(not set)
Recommendation · Add X-Content-Type-Options: nosniff to all responses.
Why it matters ↓

Stops browsers from interpreting uploaded or mislabelled files as scripts or stylesheets.

How we check: Checks that X-Content-Type-Options is set to nosniff.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
infoConfirmed

Permissions-Policy not set

Embedded content may request browser features the site never uses.

Permissions-Policy
(not set)
Recommendation · Add a policy disabling unused features, e.g. Permissions-Policy: camera=(), microphone=(), geolocation=().
Why it matters ↓

Limits what embedded third-party content can access, such as camera, microphone or payment APIs.

How we check: Checks for a Permissions-Policy header restricting powerful browser features.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
infoConfirmed

Referrer-Policy not set

Modern browsers default to a safe policy, but older ones may send full URLs to other sites.

Referrer-Policy
(not set)
Recommendation · Add Referrer-Policy: strict-origin-when-cross-origin.
Why it matters ↓

URLs can contain tokens, wallet addresses or referral codes. A strict policy keeps them from leaking to third parties.

How we check: Reads the Referrer-Policy header and flags policies that leak full URLs to other sites.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
No exact versions disclosedPassed
Server headers don't reveal exact software versions.

Cookie configuration

All checks passed
Secure flag: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
HttpOnly: no session cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.
SameSite: no cookies setPassed
No cookies were set while loading the homepage, so there is nothing to misconfigure here.

DNS & email posture

3 findings
mediumConfirmed

No DMARC policy

Receiving mail servers aren't told what to do with mail that spoofs this domain.

Lookup
_dmarc.themoths.art
Recommendation · Publish _dmarc TXT v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain and move to p=reject once reports look clean.
Why it matters ↓

DMARC tells receiving mail servers to reject mail that fails authentication — the main defence against spoofed announcements from your domain.

How we check: Reads the _dmarc TXT record for the domain or its organizational domain and checks the policy.

https://dmarc.org/overview/
lowConfirmed

No CAA records

Any certificate authority may issue certificates for this domain.

Recommendation · Publish CAA records naming the CAs you use, e.g. 0 issue "letsencrypt.org".
Why it matters ↓

CAA restricts which certificate authorities may issue certificates for the domain, reducing the risk of a mis-issued certificate.

How we check: Looks up CAA records for the domain and its parents.

https://datatracker.ietf.org/doc/html/rfc8659
lowConfirmed

DNSSEC not enabled

DNS answers for this domain are not cryptographically signed.

AD flag
not set
Recommendation · Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
Why it matters ↓

DNSSEC prevents forged DNS answers from sending visitors to a look-alike server.

How we check: Resolves the domain through a validating resolver and checks whether the answer is DNSSEC-authenticated.

https://www.cloudflare.com/dns/dnssec/how-dnssec-works/
SPF record publishedPassed
Authorised mail senders are declared.
TXT
v=spf1 include:spf.efwd.registrar-servers.com ~all

Frontend & disclosure

1 finding
infoConfirmed

No security.txt

There is no published channel for reporting vulnerabilities.

https://themoths.art/.well-known/security.txt
HTTP 404
Recommendation · Publish /.well-known/security.txt with Contact and Expires fields (see securitytxt.org).
Why it matters ↓

Gives researchers a clear way to report vulnerabilities privately instead of disclosing them publicly.

How we check: Requests /.well-known/security.txt and checks it contains a Contact field and has not expired.

https://securitytxt.org/
No mixed contentPassed
All resources referenced in the homepage HTML use HTTPS or relative URLs.
No third-party scripts in the HTMLPassed
All script tags in the homepage HTML load from the site's own domain.

Web3 frontend

1 finding
infoPotential · needs review

5 of 6 referenced addresses without verified source on Sourcify

These addresses appear in the page code but have no verified source on Sourcify for Ethereum, Base, Arbitrum One, OP Mainnet, Polygon, BNB Chain. They may be wallets rather than contracts, live on another chain, or be verified elsewhere, such as Etherscan.

Unverified address
0x93DE2637e373233CF6cAf140d1f1708F9598E53F
Unverified address
0x9f2288f487aE83Af4F30bed145ee0D625e409d1d
Unverified address
0x711A78921ec7Ce0664Eb106aF7555A1eBeaaaD8d
Unverified address
0x342Dacd39894bA3f73d362C3d5EcF6d6cA38d380
Unverified address
0x7eD598BcEf8bd9Edd8C97A195C6d13f40801EC7e
Recommendation · Verify the source of every contract users interact with on Sourcify and the relevant block explorer.
Why it matters ↓

Users should be able to read the code they're asked to interact with. Unverified addresses aren't necessarily unsafe, so this is informational only.

How we check: Extracts EVM addresses referenced in the page code (up to 6) and checks Sourcify for verified source on Ethereum, Base, Arbitrum, OP Mainnet, Polygon and BNB Chain.

https://docs.sourcify.dev/
No known-malicious releases referencedPassed
Checked 12 scripts and the homepage HTML against published malicious wallet-package releases.
Wallet stack detected
viem
No wallet code loaded from public CDNsPassed
Wallet and chain libraries are not fetched from public CDNs at runtime.
No source maps referencedPassed
None of the 12 scripts and the homepage HTML reference a source map.

Wallet stack detected

  • viem

Inspected 12 scripts (891 KB) that the homepage loads for every visitor, plus the HTML. Lazy-loaded code beyond these may not be covered.

Contracts referenced in page code

  • 0x93DE…E53Fno Sourcify match
  • 0x9f22…9d1dno Sourcify match
  • 0x711A…aD8dno Sourcify match
  • 0x342D…d380no Sourcify match
  • 0x7eD5…EC7eno Sourcify match
  • 0x8366…0951Ethereum

Verification status from Sourcify. Green chains link to the block explorer.

Agent trace

37 steps · every action the agent took
Show the full trace ↓
  1. 0.0s▸Premium assessment of themoths.art · budget 100 requests
  2. 0.0s✓Resolved themoths.art → 216.198.79.1, all public
  3. 0.1s▸Probing HTTPS, HTTP and legacy TLS
  4. 0.4s✓GET https://themoths.art/ → 200 in 281ms
  5. 0.4s·GET http://themoths.art/ → 308 https://themoths.art/
  6. 0.4s✓TLS 1.0 handshake refused
  7. 0.4s✓TLS 1.1 handshake refused
  8. 0.4s·Security headers present: strict-transport-security
  9. 0.4s·0 cookies set on the homepage
  10. 0.5s▸Reading DNS, security.txt and the page's JavaScript
  11. 0.5s·Homepage references 12 scripts; reading 3douyljdx_-l2.js, 169fhb2n-ykvs.js, 42cgv95zkx8qg.js, 02hyld8jodk6i.js, turbopack-1byz1flvc-bu1.js, 1xdzn4g2xsrj9.js
  12. 0.5s·DNS: DNSSEC off · CAA none · SPF set · DMARC none
  13. 0.7s·security.txt not found (HTTP 404)
  14. 0.7s·Following imports: 6 more chunks found; reading 2fqts2t-2tn_3.js, 1esuz3neqk91f.js, 1uzfxftfl4a58.js, 1aizz3diilv7m.js, 1zdxao5h-zr-r.js, 0c0hxoamwjsbw.js
  15. 0.9s·3douyljdx_-l2.js (5 KB)
  16. 0.9s·169fhb2n-ykvs.js (33 KB)
  17. 0.9s·42cgv95zkx8qg.js (225 KB)
  18. 0.9s·02hyld8jodk6i.js (161 KB)
  19. 0.9s·turbopack-1byz1flvc-bu1.js (11 KB)
  20. 0.9s·1xdzn4g2xsrj9.js (13 KB)
  21. 0.9s·2fqts2t-2tn_3.js (195 KB)
  22. 0.9s·1esuz3neqk91f.js (14 KB)
  23. 0.9s·1uzfxftfl4a58.js (29 KB): viem
  24. 0.9s·1aizz3diilv7m.js (48 KB)
  25. 0.9s·1zdxao5h-zr-r.js (47 KB)
  26. 0.9s·0c0hxoamwjsbw.js (110 KB)
  27. 0.9s·Wallet stack: viem
  28. 0.9s▸Found 6 contract addresses in page code; checking Sourcify on 6 chains
  29. 3.3s·0x93DE…E53F: no Sourcify match
  30. 3.3s·0x9f22…9d1d: no Sourcify match
  31. 3.3s·0x711A…aD8d: no Sourcify match
  32. 3.3s·0x342D…d380: no Sourcify match
  33. 3.3s·0x7eD5…EC7e: no Sourcify match
  34. 3.3s✓0x8366…0951 verified on Ethereum
  35. 3.4s✓Graded D (58/100) · 0 high, 3 medium, 3 low · 24 requests to the target
  36. 3.5s◆Writing summary with openai/gpt-oss-120b
  37. 10.4s◆Summary ready · 5 prioritized fixes

Scope & limitations

Assessment type
Premium, public, non-invasive
Payment
Complimentary
Target
themoths.art
Final URL
https://themoths.art/
Resolved addresses
216.198.79.1
Scanned
Oct 20, 2026, 17:29 UTC
Duration
3.4s
Requests made
24 (budget 100)
Report ID
k8rbskbyez
  • This is a public, non-invasive assessment of externally visible configuration. It does not test application logic, authentication, APIs, smart contracts or wallet flows.
  • Only the homepage, up to 8 of the scripts it loads, and a few well-known paths were requested. Other pages, lazy-loaded code and subdomains may be configured differently.
  • A good grade means the checked controls are in place. It does not prove the application is secure.

Own themoths.art? Verified owners will be able to request authorized deeper testing and receive findings privately. To dispute a result or opt out of public assessments, see opt-out & abuse reporting.