Farcaster

I decide to public this info/report
dear cc @dwr.eth @warpcast 

I've discovered an issue on Warpcast that allows someone to bind wallet address to any others without being authorized.

Affected:
- Warpcast Web
- Warpcast App (send email link)

Simple explanation for reproduce:
When you click the button to verify your wallet on either of these affected services, it grants public authorization for a limited time. During this period, malicious actors can bind their wallet address to your Warpcast using your FID.

Impact: 
This could replace your recipient's address for any transactions on Farcaster, including airdrops (degen, ham, etc..).

$DEGEN

Quick tip: If you lock more Degen, the vault auto-extends the lock-up period for your entire balance by 3 months. To avoid this, use multiple wallets on Farcaster and lock separately. We’ll sum your locked Degen across wallets for tip allowances. This is a workaround for now—future updates might change this!

2mo ago, Ive reached out to @horsefacts.eth about a security issue on 'Verified Addresses', but it looks like there's still no update. The thing is, users might not even notice if someone else adds a new wallet address to their account. This is because the new address won't show up in Wc, and you can only see it through the Fc API (like @neynar). This could happen if someone uses a bot script to scan accounts in real-time based on their sequential FID. Until this gets fixed, just make sure to double-check your verified addresses list at least 20 minutes after adding a new address to your Wc using neynar.

I'm eth newbie..just learning
(working on @farcaster)

terminally.online

best farcaster developers build on neynar.com | /neynar

2mo ago, Ive reached out to @horsefacts.eth about a security issue on 'Verified Addresses', but it looks like there's still no update. The thing is, users might not even notice if someone else adds a new wallet address to their account. This is because the new address won't show up in Wc, and you can only see it through the Fc API (like @neynar). This could happen if someone uses a bot script to scan accounts in real-time based on their sequential FID. Until this gets fixed, just make sure to double-check your verified addresses list at least 20 minutes after adding a new address to your Wc using neynar. https://warpcast.com/jacek/0x40c845cf

just for fun • security researcher • share my findings to bring security awareness • /dev /infosec /farcaster /bot

Palangkaraya, Jekan Raya, Palangka Raya City, Central Kalimantan, Indonesia

maybe get try getting v’s attention or try reaching out to someone else to get their attention.

1.)web3 NEWBIE  2.)memer 3.)Trying to build 4.)shitposter💩 5.) charts📈

hope this public report gets attention from all the teams in charge, maybe that's a better way