Le Hash on Warpcast

Content pfp

0 reply

0 recast

0 reaction

Le Hash pfp

GM 🫡 Are you ready to see one of the most stupid vulnerability you will ever see in crypto space? Here is the first vulnerability I found about the WalletConnect's Verify API 👇

1 reply

1 recast

1 reaction

Le Hash pfp

They have already pushed a fix, so I guess I can explain it now, and you can share it too 😎 https://github.com/WalletConnect/walletconnect-monorepo/commit/0d42d705f658f4da031fc69cb3411ab77b8b976b

1 reply

0 recast

1 reaction

Le Hash pfp

Here is a live demo 🔥 Click on the following links and try to connect the former with the latter wc-exploit-1.vercel.app wc-wallet.vercel.app Here is what you should see with and without the exploit Hola, Pancakeswap 👋

1 reply

0 recast

1 reaction

Le Hash pfp

So how does it work? The dapp can simply tell the wallet: "I swear I am legit, here is a server that will say I'm legit" 🫣 (and of course, the server is owned by the same person — the attacker ) Yes, that's the vulnerability 🤡

1 reply

0 recast

1 reaction

Le Hash pfp

Did I lie when I said I can exploit it with one line of code? 😅 https://github.com/hazae41/wc-exploit-1/tree/main/src/app

1 reply

0 recast

1 reaction

Le Hash pfp

Well technically two if you count the server side too https://github.com/hazae41/wc-exploit-1/blob/main/src/app/api/attestation/%5Bany%5D/route.ts

1 reply

0 recast

1 reaction

Le Hash pfp

Remember, per the docs "Verify API is not designed to be bulletproof but to make the impersonation attack harder and require a somewhat sophisticated attacker." Very sophisticated attack 😂

1 reply

0 recast

1 reaction

Le Hash pfp

Are you still overestimating your security, Pedro? 🤨 Or were you talking about a potential backdoor? 🧐

1 reply

0 recast

1 reaction

Le Hash pfp

Since you claimed that your team knew this issue, maybe it was a backdoor then? 🤨

1 reply

0 recast

1 reaction

Le Hash pfp

Oh no, you also claimed that the purpose of the Verify API wasn't to prevent phishing, so it was just an easter egg 🫠 https://x.com/hazae41/status/1710295763564081259

1 reply

0 recast

1 reaction