Security: Subdomain Takeover on app.lyra.finance and v2.lyra.finance (Vercel DEPLOYMENT_NOT_FOUND)

[interesnocto2-boop]

Subdomain Takeover Vulnerability

Severity: Critical
Affected subdomains:

• app.lyra.finance → CNAME cname.vercel-dns.com → DEPLOYMENT_NOT_FOUND
• v2.lyra.finance → CNAME cname.vercel-dns.com → DEPLOYMENT_NOT_FOUND

Proof of Concept

$ dig +short CNAME app.lyra.finance
cname.vercel-dns.com.

$ curl -s https://app.lyra.finance | head -5
The deployment could not be found on Vercel.

DEPLOYMENT_NOT_FOUND

$ dig +short CNAME v2.lyra.finance
cname.vercel-dns.com.

$ curl -s https://v2.lyra.finance | head -5
The deployment could not be found on Vercel.

DEPLOYMENT_NOT_FOUND

Impact

Both subdomains point to Vercel via CNAME but the associated Vercel projects no longer exist. An attacker can:

1. Create a free Vercel account
2. Deploy a malicious project and claim the custom domain app.lyra.finance
3. Host a fake Lyra Finance interface that steals user wallet connections and private keys via MetaMask/WalletConnect phishing
4. Steal funds from users who visit the official-looking URL

This is especially dangerous since app.lyra.finance is the primary application URL that users have bookmarked.

Steps to Reproduce

1. curl -s https://app.lyra.finance → returns DEPLOYMENT_NOT_FOUND
2. curl -s https://v2.lyra.finance → returns DEPLOYMENT_NOT_FOUND

Remediation

Either:

• Re-deploy the Vercel project and reclaim the domain
• Remove the dangling CNAME DNS records for app and v2 subdomains pointing to cname.vercel-dns.com

Reported by: Security researcher via responsible disclosure