Main dApp with a compromised iframe