Content spoofing via parameters url, w, and q (unauthenticated and wallet-connected)

Browsing the dedprz.virtual.tech site emitted requests like:

The url, w, and q parameters had predictable values that could be modified in-flight by an attacker controlling the user's network or by hooking into the page. Substituting url swapped the rendered image, allowing self-defacement style content spoofing while components were loading (e.g., swapping the "tails" image for "heads").

• Content spoofing inside the trusted origin — useful for social-engineering or screenshots-as-proof.
• Lower threshold for follow-on attacks if any image substitution path interacts with game state.

• Validate url server-side against a closed allowlist of expected static assets rather than passing arbitrary paths through Next's image optimizer.
• Constrain w and q to a fixed set of allowed values.
• HTML-encode and bound any reflected text content that derives from these parameters.

Dedprz: Acknowledged. Zealynx: Acknowledged.