Farcaster

I decide to public this info/report
dear cc @dwr.eth @warpcast 

I've discovered an issue on Warpcast that allows someone to bind wallet address to any others without being authorized.

Affected:
- Warpcast Web
- Warpcast App (send email link)

Simple explanation for reproduce:
When you click the button to verify your wallet on either of these affected services, it grants public authorization for a limited time. During this period, malicious actors can bind their wallet address to your Warpcast using your FID.

Impact: 
This could replace your recipient's address for any transactions on Farcaster, including airdrops (degen, ham, etc..).

$DEGEN

Quick tip: If you lock more Degen, the vault auto-extends the lock-up period for your entire balance by 3 months. To avoid this, use multiple wallets on Farcaster and lock separately. We’ll sum your locked Degen across wallets for tip allowances. This is a workaround for now—future updates might change this!

2mo ago, Ive reached out to @horsefacts.eth about a security issue on 'Verified Addresses', but it looks like there's still no update. The thing is, users might not even notice if someone else adds a new wallet address to their account. This is because the new address won't show up in Wc, and you can only see it through the Fc API (like @neynar). This could happen if someone uses a bot script to scan accounts in real-time based on their sequential FID. Until this gets fixed, just make sure to double-check your verified addresses list at least 20 minutes after adding a new address to your Wc using neynar.

I'm eth newbie..just learning
(working on @farcaster)

terminally.online

best farcaster developers build on neynar.com | /neynar

2mo ago, Ive reached out to @horsefacts.eth about a security issue on 'Verified Addresses', but it looks like there's still no update. The thing is, users might not even notice if someone else adds a new wallet address to their account. This is because the new address won't show up in Wc, and you can only see it through the Fc API (like @neynar). This could happen if someone uses a bot script to scan accounts in real-time based on their sequential FID. Until this gets fixed, just make sure to double-check your verified addresses list at least 20 minutes after adding a new address to your Wc using neynar. https://warpcast.com/jacek/0x40c845cf

just for fun • security researcher • share my findings to bring security awareness • /dev /infosec /farcaster /bot

Palangkaraya, Jekan Raya, Palangka Raya City, Central Kalimantan, Indonesia

In Wc you can navigate to settings>verified address, in neynar you can go to https://docs.neynar.com/reference/user-bulk put your FID and check

How can I programmatically check my verified address list? I haven't added an address since I first created my account.

I post Memes, I'm 96 year old child: /chatfcp
Whatever I post is not financial advice always do your own research

There's a broken access control though FID on the affected function

How is this possible any other people to add address on our wc?

1.)web3 NEWBIE  2.)memer 3.)Trying to build 4.)shitposter💩 5.) charts📈

hope this public report gets attention from all the teams in charge, maybe that's a better way

maybe get try getting v’s attention or try reaching out to someone else to get their attention.

You can also check verified addresses on @payflow 

1. by searching for particular FC user
2. in your wallets lists in contacts
3. in your wallets you can use to send payments

Onchain Social Payments /payflow - join at payflow.me - built by @sinaver.eth - feedback at payflowme.canny.io