# Mvx Dapp Audit > Auditing dApps and standard Frontend flows. Use when this capability is needed. - Skill: `tomevault-io/mvx-dapp-audit` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/mvx-dapp-audit` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/mvx-dapp-audit/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Web & Frontend - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/mvx-dapp-audit --- # MultiversX dApp Auditor This skill helps you audit the frontend components of a MultiversX application (`sdk-dapp`). ## 1. Transaction Construction - **Critical Logic**: The frontend constructs the payload. - **Attack**: Can a malicious frontend user change the payload before signing? - Example: `func@args` -> `func@evil_args`. - **Mitigation**: The Smart Contract MUST validate everything. Do not trust the frontend to validate inputs. ## 2. Signing Security - **Blind Signing**: Does the dApp verify what it asks the user to sign? - **Hash Signing**: Is the user signing a hash (opaque) or a clear message? ## 3. Sensitive Data - **Local Storage**: Is the private key or mnemonic ever stored in `localStorage`? (Should NEVER be). - **XSS**: Can an attacker extract the `accessToken`? ## 4. Tools - **Burp Suite**: Proxy traffic to see what the dApp sends to the API or Blockchain Proxy. - **Inspect Element**: Check network tab for `POST /transactions` payloads. --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/multiversx) — claim your Tome and manage your conversions.