VL-2026-041: Multiple Critical Vulnerabilities in veNFT Lending Protocol

Finding 1: Unauthenticated Vote Manipulation API

Two API endpoints accept POST requests without any authentication, wallet signature verification, or rate limiting. An attacker can inject arbitrary vote data for any tokenId, potentially manipulating protocol governance and reward distribution.

POST /api/[REDACTED]-vote
Content-Type: application/json

{"tokenId":"[ANY]","userAddress":"[ANY]",
 "pools":["[ATTACKER_POOL]"],"weights":[100],
 ...}

Response: {"success": true}

The same vulnerability exists in the corresponding deletion endpoint, allowing an attacker to remove legitimate votes without authorization.

Finding 2: Prototype Pollution via API Input

The vote API does not sanitize input objects, allowing __proto__ and constructor.prototype properties to be stored in the database. If the backend processes these records using unsafe deep merge operations (e.g., lodash.merge), this could lead to remote code execution on the bot server.

POST /api/[REDACTED]-vote
{"tokenId":"1", ...,
 "__proto__": {"isAdmin": true}}

Response: {"success": true}  // Stored in DB

Finding 3: CORS Wildcard + Missing Email Security

The application returns Access-Control-Allow-Origin: * for all API endpoints, enabling cross-origin attacks. Additionally, the primary domain lacks SPF, DKIM, and DMARC records, making it trivially spoofable for phishing attacks targeting protocol team members.

Finding 4: Exposed Staging Environment

A staging deployment is publicly accessible at staging.[DOMAIN] with a different build from production. Error messages from the staging environment leak internal RPC URLs, contract addresses, and library versions.