How to hack into NFT websites?

Uploading files is used for hacking NFT marketplaces

If a company uses the IPFS server for storing NFTs, there is always a possibility to upload malicious files. That’s because IPFS typically render the HTML content.

This vulnerability can be exploited by injection of the JavaScript payload to the uploaded file.

Check our blog or Twitter to learn more about this vulnerability


💬 Twitter

Are you feeling lucky today?

Have a chance to win a coupon for 25 USDT
All you have to do is:

1. Follow HackenProof in 💬
2. Like & retweet post

The winner will be selected randomly on Friday 17th February.

Good luck!

✅  Chainstack has been listed on HackenProof:

The project rewards up to $2,000 per critical bug.

ℹ️ About Chainstack:
Chainstack is a blockchain infrastructure-providing company. The managed blockchain services make it simple to launch and scale decentralized networks and applications.

💸 Chainstack bug bounty rewards hackers according to these tiers:
Critical: $1,200 – $2,000
High: $500 – $1,200
Medium: $200 – $500
Low: $50 – $200

Once you’re ready, click here to join the bounty hunt!

💬Twitter

#new_bounty

Exciting news!
Kyiv Ethereum Community is resuming regular meetups and workshops.

The 7th Kyiv Ethereum Community Meetup, the first event of 2023, will take place on February 28th.
Where Mykhailo, a security analyst at #HackenPoof will take a part as a speaker.

Ilya will be discussing the future of the fashion industry in the world of web3 and the associated technologies. Mykhailo will also talk about how bug bounties help save millions of dollars.

Registration is available at: https://payment.primsell.com/635863231

- Location: UNIT.Core Hall, Campus B8, UNIT.City, 3 Dorohozhytska Street, Kyiv
- Date and Time: February 28th, 7:00 PM - 10:00 PM
- Cost: €5 (100% of the money will be donated to the Armed Forces)

Join Kyiv Ethereum Community to meet your friends, and discuss future web3 trends. Delicious food, drinks, and good company await you!

Partners that make this event possible: Incrypted, UNIT.City, IdeaSoft, Sigma Software University, tv7.studio

💬Twitter

Yesterday zksync launched Era∎ Mainnet! Due to this event, we researched the security of the its ecosystem.

The goal was to determine how much zksync projects are secured and we used 2 factors to calculate this:
-code audits
-bug bounties.

zkSync has an impressive number of projects secured by code audit or bug bounty program (50% from all dApps, infrastructure and wallet projects). This is a lot compared to Near protocol or Avalanche.

Learn more on our blog!

💬Twitter

#security_research

NEAR has listed 2 new programs on #HackenProof:

For new bounties, the project rewards up to $50,000 per critical bug.

There are 5 assets to scope!
- http://wallet.near.org
- Web

Start bug bounty hunting right now!

💬Twitter

#new_bounty

✅  AssetMantle has been listed on HackenProof:

The project rewards up to $1,000 per critical bug.

ℹ️ About AssetMantle:
AssetMantle is a one-stop NFT framework that empowers and incentivizes creators and their fans to build, innovate, and transact independently, and securely on the blockchain via MantlePlace and MantleBuilder.

💸 AssetMantle bug bounty rewards hackers according to these tiers:
Critical:$1,000 - $1,000
High:$500 - $500
Medium:$100 - $100
Low:$0 - $0


Once you’re ready, click here to join the bounty hunt!

💬Twitter

#new_bounty

✅  DODO has been listed on HackenProof:

The project rewards up to $10,000 per critical bug.

ℹ️ About DOOD:
DODO is a decentralized trading platform that uses the innovative Proactive Market Maker (PMM) algorithm to provide efficient on-chain liquidity for Web3 assets, making it easy for everyone to issue and trade these assets

💸 DODO bug bounty rewards hackers according to these tiers:
- Critical:$5,000 - $10,000
- High:$1,000 - $5,000
- Medium:$500 - $1,000
- Low:$500 - $1,000

Once you’re ready, click here to join the bounty hunt!

💬Twitter

#new_bounty