Warpcast

Still no update yet!

I came across a similar vulnerability related to this and I'm planning to test a real exploit tomorrow. I'll be able to show you how to steal your assets. Today, I'm working on creating an exploit bot to run on my vps.

https://dune.com/queries/4078976: If your asset was stolen by these address, it'll be sent back once the issue gets fixed. Don't worry!

builder, realized the issue? DC me for the details issue to fix!

Hey everyone, 
as I mentioned earlier since its still not update yet. Today, I simulated a real bot attack to target degen.mint.club (@mcdegen), which had the same issue as @warpcast. It affected 47 users and resulted in 279,695 swapped $degen. I'll send out refunds ASAP, hopefully by tomorrow, according to the list here (https://dune.com/queries/4083858).

Based on this, I think it's clear that @warpcast will be more vulnerable to this issue. Pls help me prioritize fixing it ASAP!

cc: @dwr.eth @undefined @jacek @mcdegen

Working on Farcaster and Warpcast. Longer thoughts at https://dwr.email

full sack developer intern at /farcards /mintclub warpcast.tools 🔫 my code breaks things :( 


Tip $DEGEN to mint tokens on degen.mint.club 🎩

just for fun • security researcher • share my findings to bring security awareness • /dev /infosec /farcaster /bot

Palangkaraya, Jekan Raya, Palangka Raya City, Central Kalimantan, Indonesia

O noticed that, will update the list once the refund is done. Im on it

I am also affected but not found in that list, what should I do?

I decide to public this info/report
dear cc @dwr.eth @warpcast 

I've discovered an issue on Warpcast that allows someone to bind wallet address to any others without being authorized.

Affected:
- Warpcast Web
- Warpcast App (send email link)

Simple explanation for reproduce:
When you click the button to verify your wallet on either of these affected services, it grants public authorization for a limited time. During this period, malicious actors can bind their wallet address to your Warpcast using your FID.

Impact: 
This could replace your recipient's address for any transactions on Farcaster, including airdrops (degen, ham, etc..).

I changed ur primary address on degen.mint.club, the same issue on warpcast read here https://warpcast.com/0xsec.eth/0x5b7cbef7

frame developer, web3 developer, long distance runner /streme /pixelnouns /frm /degendogs /degenfers /toka /maxis

I am on your list. Can you explain the nature of the issue?

thanks for raising this awareness 200 $degen

@dwr.eth has this issue been solved? It looks like this user reported this bug a while ago and now he successfully exploited it yesterday.

(waiting for the assets to be returned).

Hi @0xsec.eth are refunds still pending? Thank in advance.

I'm eth newbie..just learning
(working on @farcaster)

terminally.online

Hmmm this is so scary, it means my account can be hacked anytime? have you taken a look of this? @dwr.eth @undefined @horsefacts.eth i don't even want to give this exposure so someone in the bad side gets to it...

So happy you're on the side of good.

Crypto could be mainstream by now. A legit used household name. If only there weren't so many..so so many instances where newly onboarded users were exploited either out of ignorance or pure inexperience. 


Thanks for proving the flaw and hopefully a remedy will happen this time..


🍖 x 1000 $DEGEN

I was one of the affected users. Thank you for raising awareness on this, and sorry it had to be done in this way.

I recasted for visibility 👀

So what happened and how did you attack (not to much detail so others can't replicate)

Farcaster OG | FID: 10174 | @fireflyapp Ambassador | /bnfarcaster 🎙 in Spanish  | https://web3.bio/cryptowenmoon.eth

@cryptowenmoon.eth @borst.eth i saw yall are on here frens