makerdao/awesome-makerdao

A collection of tools, documents, articles, blog posts, interviews, and videos related to MakerDAO and the Dai stablecoin.

awesome-makerdao's Issues

Makerdao

add the new dais

cDai
rDai
lsDai
i think there's others.

Multiple crtical vulns

Current image	python:3.6.6	Vulns: 1097	83C260H286M468L
Minor upgrades	python:3.10.0b4	Vulns: 445	12C56H86M291L

Current image | python:3.6.6

Critical : 83

python:3.10.0b4

Critical: 12

add https://daiauctions.com/

Can we add https://daiauctions.com/ to the metrics for users browse acution process?

mocki information exposure graphql.js

Disable X-Powered-By header for your Express app (consider using Helmet middleware), because it exposes information about the used framework to potential attackers.

const express = require('express');
const bodyParser = require('body-parser');
const { ApolloServer } = require('apollo-server-express');
const supertest = require('supertest');
const { buildClientSchema } = require('graphql');

const generateMocks = obj => {
const result = {};
for (const property in obj) {
result[property] = () =>
typeof obj[property] === 'object' && !Array.isArray(obj[property])
? generateMocks(obj[property])
: obj[property];
}
return result;
};

const graphql = async (endpoint, req) => {
const schema = buildClientSchema(endpoint.graphql.schema);

const server = new ApolloServer({
schema,
path: '/',
mocks: endpoint.graphql.mocks ? generateMocks(endpoint.graphql.mocks) : true
});

const app = express();
app.use(bodyParser.json());
server.applyMiddleware({ app, path: '/' });

const result = await supertest(app).post('/').send(req.body);

return result.body;
};

module.exports = graphql;

Subgraph for MakerDao

Hi. There are two working subgraphs for Maker
https://thegraph.com/explorer/subgraph/protofire/makerdao
https://thegraph.com/explorer/subgraph/protofire/maker-protocol

But they could be improved. And new ones could be implemented. Would ask someone of Maker community to check this topic.

XSS

res.set(
'Access-Control-Allow-Headers',
'Origin, X-Requested-With, Content-Type, Accept'
);
return res.send(graphqlResponse);

Unsanitized input from the HTTP request body flows into send, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

node fetch

Fix: Your dependencies are out of date, otherwise you would be using a newer node-fetch than [email protected]. Try relocking your lockfile or deleting node_modules, reinstalling and running . If the problem persists, one of your dependencies may be bundling outdated modules.
Overview
is a light-weight module that brings window.fetch to node.js

Affected versions of this package are vulnerable to Information Exposure when fetching a remote url with Cookie, if it get a Location response header, it will follow that url and try to fetch that url with provided cookie. This can lead to forwarding secure headers to 3th party.

Your logo is a rip-off from DICE.money which predated this project

Advisable action - change the logo.

Found a dead link in awesome-makerdao

https://github.com/makerdao/awesome-makerdao

The first link of "Watch your Dai" section:

Watch your Dai

• CDP Alert: Alerts on Dai Collateralized Debt Positions !!!THIS IS A DEAD LINK!!!

XSS(High) mocki

res.set(
'Access-Control-Allow-Headers',
'Origin, X-Requested-With, Content-Type, Accept'
);
return res.send(graphqlResponse);

Unsanitized input from the HTTP request body flows into send, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Remove duplicates

This list needs a little reorganization, because now we have some links twice, for example Stablecoin Index, mkr.tools, oasis.

Directory Traversal

Directory Traversal
Vulnerable module: adm-zip
Introduced through: [email protected]
Detailed paths
Introduced through: [email protected]
Remediation: Upgrade to [email protected].
Overview
adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Directory Traversal. It could extract files outside the target folder.

https://nvd.nist.gov/vuln

Adding POA Network partnership + xDai Chain resources

The readme file is missing the following:

• Partnership with POA Network
• xDai Chain resource portal

Opera Crypto Wallet

Hello team,

May I ask you to reference Opera Crypto Wallet to the list of referenced wallets please ?

https://www.opera.com/crypto

Thank you

add hackathon projects subpage

having a list of the winners/bounty seekers from the hackathons could be cool

Addd SimpleHold wallet

Add SimpleHold.io wallet to the wallet section - https://simplehold.io/coins/ethereum/maker

Update to new governance architecture

It would be great if you guys update the resources for New governance architecture of Maker and add spark protocol resources as well