Will be considered as MEDIUM

Will be considered as LOW

Both are functions for different purposes

Awaiting response from the reported on the Issue

This is overriden in another contract with both the values passed

Latest patch from Zeppelin negates this for ERC20 compliance

There are bots that can make fake account with fake emails so fast that there will be so many more fake accounts than real accounts.

https://alloy.rewards.network

0xdd30dd6fbaae31ffc01c08e2392f76c0459c8527

You can simply spam anyones email with the password reset function, just buy a vps and install macro bot, or write a simple autobot script that will submit an email in the password reset field and hit submit and do this over and over again all day long.

https://alloy.rewards.network

0xdd30dd6fbaae31ffc01c08e2392f76c0459c8527

DDOS Protection Required

https://alloy.rewards.network

0xdd30dd6fbaae31ffc01c08e2392f76c0459c8527

As there is no rate limit set,an attacker can successfully perform brute force/huge email bombing/cookie bombing/email spoofing on the victim's account.

https://alloy.rewards.network/login

->No rate limit has been set for login form
->As there is no rate limit set,an attacker can successfully perform brute force/huge email bombing/cookie bombing/email spoofing on the victim's account.

0x758423cB715492C8E269C7Ec46159F2f71737224

Throttling of Login was already present but with no Visual clues. Visual message has been added in this effect.

Form Password Field with Autocomplete Enabled

form that included a password input field. The autocomplete attribute was not set to off. This may result in some browsers storing values input by users locally, where they may be retrieved by third parties.

https://alloy.rewards.network/login

A password value may be stored on the local filesystem of the client.
Locally stored passwords could be retrieved by other users or malicious code.

0x758423cB715492C8E269C7Ec46159F2f71737224

User's privilege & convinence. Many popular browsers allow users to save the Login credentials. How and where the creds are stored by the browser is a different topic altogether

Cookie HttpOnly Flag Not Set

cookie was set without the HttpOnly flag. When this flag is not present, it is possible to access the cookie via client-side script code. The HttpOnly flag is a security measure that can help mitigate the risk of cross-site scripting attacks that target session cookies of the victim. If the HttpOnly flag is set and the browser supports this feature, attacker-supplied script code will not be able to access the cookie.

https://alloy.rewards.network

0x758423cB715492C8E269C7Ec46159F2f71737224

Missing HTTP security headers: X-Content-Type-Options is not set

The HTTP X-Content-Type-Options header is addressed to Internet Explorer browser and prevents it from reinterpreting the content of a web page (MIME-sniffing) and thus overriding the value of the Content-Type header). Lack of this header could lead to attacks such as Cross-Site Scripting or phishing.

I recommend setting the X-Content-Type-Options header to "X-Content-Type-Options: nosniff".

0xdd30dd6fbaae31ffc01c08e2392f76c0459c8527

HTTP Security Header: Strict-Transport-Security is not set.

The HTTP Strict-Transport-Security header instructs the browser not to load the website via plain HTTP connection but always use HTTPS. Lack of this header exposes the application users to the risk of data theft or unauthorized modification in case the attacker implements a man-in-the-middle attack and intercepts the communication between the user and the server.

I recommend setting the Strict-Transport-Security header.

0xdd30dd6fbaae31ffc01c08e2392f76c0459c8527

https://github.com/RequestNetwork/RequestTokenSale/issues/7

0x7bd81F41D03135D366F942dEF3B1479B49113C07

check pls.

https://github.com/codemojo-dr/Alloy-ICO-Contracts/blob/master/contracts/crowdsale/Crowdsale.sol

"Gets the Human readable progress for the current crowsale"

"crowsale" is false... it must be "crowdsale"

0x7bd81F41D03135D366F942dEF3B1479B49113C07

After connecting fb/twitter you can remove the app of alloy from fb and twitter setting. But in site it will still show connected & number of alloy's including fb/ twitter bounty.

https://alloy.rewards.network/facebook-bounty

connect ffb/twitter then remove it.

0xe477292f1b3268687a29376116b0ed27a9c76170

This is by design. Anyone participating in the bounty, if they unlink the accounts, wont be eligible. The Pending ALLOYs will be rechecked against the connection status before being issued.