[Security] Subdomain Takeover: 11 subdomains vulnerable (app, v1, v2, blog, gov, vote, help, stats, testnet, nft, lend)

[interesnocto2-boop]

Security Report: Multiple Subdomain Takeovers

Severity: Critical
Affected: 11 lyra.finance subdomains

Summary

Eleven Lyra Finance subdomains are vulnerable to subdomain takeover via orphaned Vercel deployments. DNS CNAME records point to deleted Vercel projects.

Affected Subdomains

Subdomain	CNAME	Response
app.lyra.finance	cname.vercel-dns.com	DEPLOYMENT_NOT_FOUND
v1.lyra.finance	cname.vercel-dns.com	DEPLOYMENT_NOT_FOUND
v2.lyra.finance	cname.vercel-dns.com	DEPLOYMENT_NOT_FOUND
blog.lyra.finance	cname.vercel-dns.com	DEPLOYMENT_NOT_FOUND
gov.lyra.finance	cname.vercel-dns.com	DEPLOYMENT_NOT_FOUND
vote.lyra.finance	cname.vercel-dns.com	DEPLOYMENT_NOT_FOUND
help.lyra.finance	cname.vercel-dns.com	DEPLOYMENT_NOT_FOUND
stats.lyra.finance	cname.vercel-dns.com	DEPLOYMENT_NOT_FOUND
testnet.lyra.finance	cname.vercel-dns.com	DEPLOYMENT_NOT_FOUND

Proof of Concept

curl -sk https://app.lyra.finance | grep DEPLOYMENT
# → DEPLOYMENT_NOT_FOUND

curl -sk https://v1.lyra.finance | grep DEPLOYMENT
# → DEPLOYMENT_NOT_FOUND

Impact

An attacker can take over app.lyra.finance — the main application URL — and:

• Serve wallet-draining malicious contracts via fake UI
• Steal private keys/seed phrases from users
• Conduct phishing attacks at the official domain

app.lyra.finance is the primary trading interface — compromise is critical.

Fix

Remove all orphaned CNAME records immediately or redeploy Vercel projects for active subdomains.