Reports in metamask program: S.No Title Bounty 1 Bypass parsing of transaction data, users on the phishing site will transfer/approve ERC20 tokens without being alerted $1000.0 2 Possible to spoof Origin in "Connected Sites" $0.0 3 MetaMask Browser URL and Transaction Origin Spoofing - Metamask wallet Android & Metamask wallet iOS $0.0 4 Arbitrary file write triggered by deeplink abuse - MetaMask Android $0.0 5 MetaMask Browser (on Android) does not enforce Content-Security-Policy header $0.0