Warpcast

Still no update yet!

I came across a similar vulnerability related to this and I'm planning to test a real exploit tomorrow. I'll be able to show you how to steal your assets. Today, I'm working on creating an exploit bot to run on my vps.

https://dune.com/queries/4078976: If your asset was stolen by these address, it'll be sent back once the issue gets fixed. Don't worry!

builder, realized the issue? DC me for the details issue to fix!

Hey everyone, 
as I mentioned earlier since its still not update yet. Today, I simulated a real bot attack to target degen.mint.club (@mcdegen), which had the same issue as @warpcast. It affected 47 users and resulted in 279,695 swapped $degen. I'll send out refunds ASAP, hopefully by tomorrow, according to the list here (https://dune.com/queries/4083858).

Based on this, I think it's clear that @warpcast will be more vulnerable to this issue. Pls help me prioritize fixing it ASAP!

cc: @dwr.eth @undefined @jacek @mcdegen

full sack developer intern at /farcards /mintclub warpcast.tools 🔫 my code breaks things :( 


Tip $DEGEN to mint tokens on degen.mint.club 🎩

just for fun • security researcher • share my findings to bring security awareness • /dev /infosec /farcaster /bot

Palangkaraya, Jekan Raya, Palangka Raya City, Central Kalimantan, Indonesia

I am on your list. Can you explain the nature of the issue?

Farcaster

I decide to public this info/report
dear cc @dwr.eth @warpcast 

I've discovered an issue on Warpcast that allows someone to bind wallet address to any others without being authorized.

Affected:
- Warpcast Web
- Warpcast App (send email link)

Simple explanation for reproduce:
When you click the button to verify your wallet on either of these affected services, it grants public authorization for a limited time. During this period, malicious actors can bind their wallet address to your Warpcast using your FID.

Impact: 
This could replace your recipient's address for any transactions on Farcaster, including airdrops (degen, ham, etc..).

I changed ur primary address on degen.mint.club, the same issue on warpcast read here https://warpcast.com/0xsec.eth/0x5b7cbef7

frame developer, web3 developer, long distance runner /pixelnouns /frm /degendogs /degenfers /toka /maxis

So means you check new verified addresses on e.g. dune and when this window is still open, you (or everyone) can add a new addresses to foreign fid?

Maybe this can help to check, but yeah serious problem 😅

Maybe this can help to check, but yeah serious problem 😅

https://fc-verified-addresses.df-frame.xyz/ff/?method=fc-verified-addresses&ts=1726817434

hey, nice frame work! 
anyways, good news - the bug got squashed, so we're all good now!

Yeah so user can easily check if sth strange was in history or maybe still

yeah, I've tried adding and removing wallet addresses, and the frame is fast at updating, awesome!

Under hub it is realtime from a hub and history is synced once a day

Nice! just a thought - typically, the app will default to the latest address as the primary one. Maybe you could label which one is the most recent, since it doesn't always show up in Warpcast, but it does appear in Neynar

Hm the normal hub seems not have the default flag, I guess it is the first in the list. But I am not sure.. never had more than 1 wallet 😅