Farcaster

2mo ago, Ive reached out to @horsefacts.eth about a security issue on 'Verified Addresses', but it looks like there's still no update. The thing is, users might not even notice if someone else adds a new wallet address to their account. This is because the new address won't show up in Wc, and you can only see it through the Fc API (like @neynar). This could happen if someone uses a bot script to scan accounts in real-time based on their sequential FID. Until this gets fixed, just make sure to double-check your verified addresses list at least 20 minutes after adding a new address to your Wc using neynar. https://warpcast.com/jacek/0x40c845cf

Still no update yet!

I came across a similar vulnerability related to this and I'm planning to test a real exploit tomorrow. I'll be able to show you how to steal your assets. Today, I'm working on creating an exploit bot to run on my vps.

https://dune.com/queries/4078976: If your asset was stolen by these address, it'll be sent back once the issue gets fixed. Don't worry!

builder, realized the issue? DC me for the details issue to fix!

microsub.

just for fun • security researcher • share my findings to bring security awareness • /dev /infosec /farcaster /bot

Palangkaraya, Jekan Raya, Palangka Raya City, Central Kalimantan, Indonesia