₦airaland Forum

💸 Turn your ideas, and opinions into earnings with Naira-X!
Join Nigerians already making money while staying connected, sharing thoughts, and engaging with the community.

✅ Post & comment
✅ Earn instantly
✅ Track your balance easily
✅ 24h withdrawal TAT to you desired bank account

visit Naira-X today and start turning your time into cash!

Please what is the URL to the said site? Searched through Google but I couldn't find it...

I cannot even post a link in peace.

This place's so backwards. Best in banning
Can't even provide a 'ban reason'. Just full ads everywhere.

How do I get the link to the site? Can we chat on WhatsApp?

NairaX:
I cannot even post a link in peace.

This place's so backwards. Best in banning
Can't even provide a 'ban reason'. Just full ads everywhere.

Check my signature and earn massively as it will be launch on 31

adeoyekay:
Check my signature and earn massively as it will be launch on 31

Goodluck on your launch

But have you thought about integrating your rewards to the "products & services" not just "referrals". Then, it will be a better reward system.

Real users are already earning.

It’s really that simple — sign up, comment on posts you actually like, and get paid instantly.

We don’t take anything from you. No fees. No ads.

Posts are crawled in real time, so there’s always fresh content. Everything is from real, verified sources, which means you only engage with posts you genuinely enjoy. You learn something new every time you log in.

Just jump on the platform — it’s way cooler over there.

I just checked your webapp, and I can see you have written it using React Vite. There are lots of vulnerabilities on it at the moment that anyone with knowledge of python can just take advantage of and bump up their earnings or spam the webapp with bot posts

I'm willing to discuss if you're interested in my findings.

One of many vulnerabilities is:

Guest Account Flooding ("Smurfing"
You defined a function Oi() that generates a guest ID.
The Code Logic: It generates a crypto.randomUUID() client-side and saves it to localStorage. It then sends this to /create-user along with browser info derived from the bt (UA-Parser) variable.

The Exploit: An attacker can generate millions of UUIDs locally and fire requests to /create-user using curl_cffi. They can cycle through User-Agent strings (which curl_cffi supports easily) to make it look like 10,000 different Android phones are signing up.

Result: They can create a botnet of "Guest" users to upvote content (ea function) or manipulate polls.


Immediate Defense for this, SET UP CLOUDFLARE CAPTCHA AT THIS '/create-user' ENDPOINT, pretty easy and fast to do

taofeeq137:
I just checked your webapp, and I can see you have written it using React Vite. There are lots of vulnerabilities on it at the moment that anyone with knowledge of python can just take advantage of and bump up their earnings or spam the webapp with bot posts

I'm willing to discuss if you're interested in my findings.

One of many vulnerabilities is:

Guest Account Flooding ("Smurfing"
You defined a function Oi() that generates a guest ID.
The Code Logic: It generates a crypto.randomUUID() client-side and saves it to localStorage. It then sends this to /create-user along with browser info derived from the bt (UA-Parser) variable.

The Exploit: An attacker can generate millions of UUIDs locally and fire requests to /create-user using curl_cffi. They can cycle through User-Agent strings (which curl_cffi supports easily) to make it look like 10,000 different Android phones are signing up.

Result: They can create a botnet of "Guest" users to upvote content (ea function) or manipulate polls.


Immediate Defense for this, SET UP CLOUDFLARE CAPTCHA AT THIS '/create-user' ENDPOINT, pretty easy and fast to do

Just to clarify a few things here.

Vite is only being used as a bundler/dev server, not as a framework choice that defines the app’s security model. The app itself is plain vanilla JS, not React-driven logic on the backend.

Guest users cannot interact in any meaningful way — they can’t earn, vote, or affect rewards. Guest creation exists purely for read-only exploration and UX onboarding, nothing more.

All real interactions and earnings require full registration, and that route is email-validated and server-side enforced. Client-side IDs (including guest UUIDs) are never trusted for privileged actions.

So even if someone spammed /create-user with fake guest IDs, it doesn’t translate into earnings, voting power, or economic impact on the platform.

That said, you’re right in principle: public endpoints should always assume hostile traffic. Rate-limiting, bot detection, and CAPTCHA (Cloudflare Turnstile specifically) are already on the roadmap for guest-related endpoints as the platform scales.

Appreciate you taking the time to look through it.

NairaX:
Just to clarify a few things here.

Vite is only being used as a bundler/dev server, not as a framework choice that defines the app’s security model. The app itself is plain vanilla JS, not React-driven logic on the backend.

Guest users cannot interact in any meaningful way — they can’t earn, vote, or affect rewards. Guest creation exists purely for read-only exploration and UX onboarding, nothing more.

All real interactions and earnings require full registration, and that route is email-validated and server-side enforced. Client-side IDs (including guest UUIDs) are never trusted for privileged actions.

So even if someone spammed /create-user with fake guest IDs, it doesn’t translate into earnings, voting power, or economic impact on the platform.

That said, you’re right in principle: public endpoints should always assume hostile traffic. Rate-limiting, bot detection, and CAPTCHA (Cloudflare Turnstile specifically) are already on the roadmap for guest-related endpoints as the platform scales.

Appreciate you taking the time to look through it.

Okay, cool, if you feel its secure, all good, done my part. Cheers. Ill check back in a few days, if I still see the vulnerabilities I'll have no choice but to make them all public. Cheers

...

taofeeq137:
...

First, running active attacks against a live platform under the guise of “vulnerability scanning” is illegal without authorization.

Second, while you may think you’re making progress, you’re not. Your attempts have been unsuccessful. Our systems, content, rewards logic, and—most importantly—user wallet balances remain completely intact and unchanged.

We detected the activity early and took immediate action to neutralize it. You’ve already been disabled.

Let this be clear: do not attempt to interfere with user wallets or financial flows. That is a hard boundary. Any further attempts will trigger a response.

This is your warning. Don’t push it.

Before Abraham was, Jesus is.

Thank you.

NairaX:
First, running active attacks against a live platform under the guise of “vulnerability scanning” is illegal without authorization.

Second, while you may think you’re making progress, you’re not. Your attempts have been unsuccessful. Our systems, content, rewards logic, and—most importantly—user wallet balances remain completely intact and unchanged.

We detected the activity early and took immediate action to neutralize it. You’ve already been disabled.

Let this be clear: do not attempt to interfere with user wallets or financial flows. That is a hard boundary. Any further attempts will trigger a response.

This is your warning. Don’t push it.

Before Abraham was, Jesus is.

Thank you.

Lol, and like VDM always say, you'll learn and you'll learn the heard way... There are at least 10 vulnerabilities on your platform, I only showed you one of them, and filtering for gmail, isnt the immediate action to neutralize that you think it is.

But like I said earlier, there are so many vulnerabilities on your platform! IT IS NOT READY FOR PRODUCTION!

Save your 13 Naira per person, go offline, get a cybersecurity analyst to work with!
If you refuse, I'll make sure you fix each and every vulnerability by force while you are online!!!

taofeeq137:
Lol, and like VDM always say, you'll learn and you'll learn the heard way... There are at least 10 vulnerabilities on your platform, I only showed you one of them, and filtering for gmail, isnt the immediate action to neutralize that you think it is.

But like I said earlier, there are so many vulnerabilities on your platform! IT IS NOT READY FOR PRODUCTION!

Save your 13 Naira per person, go offline, get a cybersecurity analyst to work with!
If you refuse, I'll make sure you fix each and every vulnerability by force while you are online!!!

You're obviously an ambitious novice at worst or a script kiddo at best.

Threatening to “force fixes” on a live system confirms exactly what we already stated: this is unauthorized activity, not responsible disclosure.

We’re not interested in bravado, intimidation, or online theatrics. If you genuinely had valid findings, the correct path would have been responsible disclosure, not attempting to exploit endpoints or issuing threats.

To be very clear:

Your actions did not impact content, users, balances, or rewards and you cannot replicate them. No one can.

Any further attempts to interfere with the platform will be treated as deliberate malicious activity.

We are comfortable with our rollout strategy and internal roadmap. Security is not a checkbox feature we “discover” from random attackers online, and we won’t be bullied into engineering decisions.

We repeat. It's impossible to. It's been over 18 hours and users are sill earning on our platform while commenting on freshly curated content. To burst your bubble, it's not NGN13 per person. Instead, its up to NGN13 per comment. You can see how much we've paid out so far under Menu > Rewards.

This conversation is over.
Do not contact us again, and do not interact with the platform further.

— Naira-X.com

Users like you are still actively getting rewarded using our platform.

✅ Available 24/7
✅ Post & comment
✅ Earn instantly
✅ Track your balance easily
✅ Free unlimited withdrawals to your NGN bank account

NairaX:
💸 Turn your ideas, and opinions into earnings with Naira-X!
Join Nigerians already making money while staying connected, sharing thoughts, and engaging with the community.

✅ Post & comment
✅ Earn instantly
✅ Track your balance easily
✅ 24h withdrawal TAT to you desired bank account

visit Naira-X today and start turning your time into cash!

I just registered and comment on a post.

How do I earn?

captain2020:
I just registered and comment on a post.

How do I earn?

You already started earning.
Select Menu > Your wallet
You can also withdraws via that same pattern.

Thank you.

NairaX:
You already started earning.
Select Menu > Your wallet
You can also withdraws via that same pattern.

Thank you.

How do I create post?
Or how do I earn more?

How do I create a Post?

NairaX:
Real users are already earning.

It’s really that simple — sign up, comment on posts you actually like, and get paid instantly.

We don’t take anything from you. No fees. No ads.

Posts are crawled in real time, so there’s always fresh content. Everything is from real, verified sources, which means you only engage with posts you genuinely enjoy. You learn something new every time you log in.

Just jump on the platform — it’s way cooler over there.

You just keep deceiving people. Where is the earn-like button on each post or even on your platform?

NairaX:
You already started earning.
Select Menu > Your wallet
You can also withdraws via that same pattern.

Thank you.

Who are you fooling ? What’s the minimum withdrawal amount ?

Fmode:
You just keep deceiving people. Where is the earn-like button on each post or even on your platform?

Select Menu > Rewards

To see your current balance in your wallet
Select Menu > Your Wallet

We have been rewarding our users and haven't failed not once. Anyone can come forward to dispute that.

Thanks.
Naira-X.com

Fmode:
Who are you fooling ? What’s the minimum withdrawal amount ?

The minimum withdrawal amount is NGN500 to any Nigerian bank account.

Currently with no associated charges or hidden fees.

Select Menu > Rewards to see more and a real-time amount we have rewarded our users.

Thanks.
Naira-X.com

captain2020:
How do I create post?
Or how do I earn more?

This is currently disabled for privacy and user data reasons and will be available once it's all ready.

Currently, users get rewarded by commenting but we have other rewards in the pipeline, such as Daily Activity, Views, Posts, and even Streaks. You can see more details under Menu > Rewards.

Thanks.

Naira-X.com

Hello @NairaX developer, I need some clarification pertaining to the website..