Work & reportsReport

Sailor LendWeb Application Security Review

View PDF on GitHub
Sailor Lend logo
All findings
2
Critical
1
High
1
Medium
0
Low
0
Informational
0

Date of engagement: 10th December 2025 - 29th December 2025

Michal Bajor

Security review by

Michal Bajor

Meet the team

About Us

Guvenkaya is a security research firm specializing in Rust security, Web3 security of Non-EVM protocols, and Web2 security. With our expertise, we provide both security auditing services and custom security solutions

About Sailor Lend

Sailor Lend is a trustless, self-custodial DeFi lending protocol built on the NEAR blockchain. The platform enables users to obtain instant loans using BTC, ZEC, or SOL as collateral without requiring KYC verification. Users can deposit stablecoins for lending to earn interest, while borrowers can leverage their crypto assets to access liquidity. The protocol implements liquidation mechanisms, interest rate calculations, and Pyth price oracle integrations.

Audit Results

Guvenkaya conducted a comprehensive security assessment of the Sailor Lend web application. During this engagement, 2 findings were reported: 1 Critical and 1 High severity issue. The critical finding includes a remote code execution vulnerability through React2Shell (CVE-2025-55182) affecting React Server Components. All findings have been addressed by the Sailor Lend team.

Project Scope

Sailor Lend Web Application

Out of Scope

The audit included reviewing the code for security vulnerabilities, coding practices, and architecture. The audit does not include a review of the dependencies or external contracts such as Pyth Oracle and FT contracts.

Timeline

  1. Start of the audit

    10th December 2025

  2. Draft report

    29th December 2025

  3. Final report

    17th March 2026

Methodology

  • RESEARCH INTO PROJECT ARCHITECTURE
  • PREPARING ATTACK VECTORS
  • SETTING UP AN ENVIRONMENT
  • MANUAL CODE REVIEW OF THE CODE
  • ASSESSMENT OF WEB APPLICATION SECURITY ISSUES
  • ASSESSMENT OF ARITHMETIC ISSUES
  • BUSINESS LOGIC VULNERABILITY ASSESSMENT

Severity Breakdown

Likelihood Ratings

Likely
The vulnerability is easily discoverable and not overly complex to exploit.
Possible
The vulnerability presents some challenges either in discovery or in the complexity of the attack.
Rare
The vulnerability is either very difficult to discover or complex to exploit, or both. This matrix provides a nuanced view, taking into account both the ease of discovering a vulnerability and the complexity involved in exploiting it.

Impact

Severe
Exploitation could result in critical loss or compromise, such as full system control, substantial financial loss, or severe reputational damage.
Moderate
Exploitation may lead to limited data loss, partial compromise, moderate financial impact, or noticeable degradation of services.
Negligible
Exploitation has minimal impact, such as minor data exposure without significant consequences or slight inconvenience without substantial disruption.

Severity Ratings

Critical
Assigned to vulnerabilities with severe impact and a likely likelihood of exploitation.
High
For vulnerabilities with either severe impact but only a possible likelihood, or moderate impact with a likely likelihood.
Medium
Used for vulnerabilities with severe impact but a rare likelihood, moderate impact with a possible likelihood, or negligible impact with a likely likelihood.
Low
For vulnerabilities with moderate impact and rare likelihood, or negligible impact with a possible likelihood.
Informational
The lowest severity rating, typically for vulnerabilities with negligible impact and a rare likelihood of exploitation.

Likelihood Matrix

Attack Complexity / Discovery EaseObviousConcealedHidden
ComplexPossibleRareRare
ModerateLikelyPossibleRare
StraightforwardLikelyPossiblePossible

Likelihood/Impact Matrix

Likelihood / ImpactSevereModerateNegligible
LikelyCriticalHighMedium
PossibleHighMediumLow
RareMediumLowInformational

Findings Summary

Remediation Complexity

This measures how difficult it is to fix the vulnerability once it has been identified.

Simple
Patches or fixes are readily available and easily implemented.
Moderate
Requires some time and resources to remediate, but well within the capabilities of most organizations.
Difficult
Remediation requires significant resources, specialized skills, or substantial changes to systems or architecture.

Status

This measures how difficult it is to fix the vulnerability once it has been identified.

Not Fixed
Indicates that the vulnerability has been identified but no remedial action has been taken yet. This status is crucial for newly discovered vulnerabilities or those awaiting prioritization.
Fixed
This status is applied when the vulnerability has been successfully remediated. It implies that appropriate measures (like patching, configuration changes, or architectural modifications) have been implemented to resolve the issue.
Acknowledged
This status is used for vulnerabilities that have been recognized, but for various reasons (such as risk acceptance, cost, or other business decisions), have not been fixed. It indicates that the risk posed by the vulnerability is known and has been consciously accepted.
Scheduled
This status indicates that the vulnerability has been acknowledged and a plan is in place to fix it in the future. It signifies that while remediation hasn't yet occurred, the issue has been prioritized and is part of the planned development roadmap.
FindingImpactLikelihoodSeverityRemediation complexityRemediation status
GUV-1: Vulnerable to React2ShellSevereLikelyCriticalSimpleFixed
GUV-2: Hardcoded Password in Source CodeModerateLikelyHighSimpleFixed

Findings Details

GUV-1: Vulnerable to React2Shell

Critical

The application is vulnerable to React2Shell (CVE-2025-55182), a critical remote code execution (RCE) vulnerability affecting React Server Components. The project currently uses React 19.0.0, which falls within the vulnerable version range (19.0.0 through 19.2.0).

This vulnerability stems from unsafe deserialization within React's "Flight" protocol, allowing unauthenticated attackers to execute arbitrary code on the server by sending specially crafted HTTP requests. The application uses Next.js 15.1.4 with the App Router, which relies on React Server Components and is therefore affected.

The vulnerability was confirmed using https://github.com/assetnote/react2shell-scanner tool.

Recommendation

We recommend updating the react version to a non-vulnerable version.

Remediation - Fixed

Sailor Lend team has fixed this issue in commit 3446235a0abc82377a266bc8c8a056c3523130fc

View this finding in the original PDF

GUV-2: Hardcoded Password in Source Code

High

The source code contains a hardcoded password that is checked before accessing the web application.

Password Check

     const passwordIsCorrect = (value: string) => {
      return value === "satoshi";
     };

Recommendation

We recommend avoiding hard-coding sensitive values in the code. The best approach would be to send the password to the backend and do the hash-based comparison there.

Remediation - Fixed

Sailor Lend team has fixed this issue in commit 3446235a0abc82377a266bc8c8a056c3523130fc

View this finding in the original PDF

Source: published GitHub report · 12 pages. The original PDF includes the source formatting, figures, and linked references.

Tell us what you need to secure.

Describe your system, main concern, and deadline. We will reply with scoping questions and a proposed next step.

Discuss your scope