The Part of Crypto Security Nobody Talks About

When people talk about crypto security, the conversation usually starts with on-chain programs and contracts. But much of what users interact with is ordinary web software: websites, APIs, databases. It fails the way any web app fails, yet receives a fraction of the attention given to what's on-chain.

Even core ecosystem projects look like this. solana-foundation/tokens, the Solana Foundation's repo behind tokens.xyz, runs on a conventional web stack, with applications, APIs, databases, and backend services.

Through our autonomous security testing of the repository, we identified two vulnerabilities. One allowed unauthorized access to another user's dashboard data. The other was a cross-site scripting issue. We disclosed both vulnerabilities privately through GitHub security advisories, and the Foundation fixed them quickly.

What we found

1. Account aliasing on wallet sign-in. A Clerk session with no email of its own (for example, from a wallet login) could POST /api/dashboard/usersUpsertMe with another user's address. That bound the attacker onto the victim's dashboard row, so later "me" calls returned that user's projects, API keys and usage. Fixed in PR #208.
2. Same-origin XSS through the image proxy. /api/image-proxy could fetch an attacker-controlled SVG from an allowlisted host and serve it asimage/svg+xml without Content-Disposition: attachment or a CSP that blocks script. Opening the proxied URL ran JavaScript as a same-origin document on tokens.xyz. While session cookies weren't exposed, the issue allowed attacker-controlled JavaScript to execute under the tokens.xyz origin, potentially enabling phishing scenarios involving a trusted domain.

The other half of disclosure

How a vulnerability report turns out depends as much on the people receiving it as on the people sending it. The Solana Foundation handled both reports well, responding promptly and shipping fixes quickly.

Open-source projects make it easier for researchers to identify issues, but what matters just as much is how teams respond when something is found.

What this shows

Neither bug needed anything exotic. One was an identity check that trusted the client. The other was an image proxy that served SVG as a live document. Both were familiar web security issues, and neither was specific to crypto.

Finding these kinds of vulnerabilities takes more than checking whether code looks secure. It means actively looking for ways an application can be exploited, and keeping up as the code changes.