Farcaster

I decide to public this info/report
dear cc @dwr.eth @warpcast 

I've discovered an issue on Warpcast that allows someone to bind wallet address to any others without being authorized.

Affected:
- Warpcast Web
- Warpcast App (send email link)

Simple explanation for reproduce:
When you click the button to verify your wallet on either of these affected services, it grants public authorization for a limited time. During this period, malicious actors can bind their wallet address to your Warpcast using your FID.

Impact: 
This could replace your recipient's address for any transactions on Farcaster, including airdrops (degen, ham, etc..).

$DEGEN

Quick tip: If you lock more Degen, the vault auto-extends the lock-up period for your entire balance by 3 months. To avoid this, use multiple wallets on Farcaster and lock separately. We’ll sum your locked Degen across wallets for tip allowances. This is a workaround for now—future updates might change this!

2mo ago, Ive reached out to @horsefacts.eth about a security issue on 'Verified Addresses', but it looks like there's still no update. The thing is, users might not even notice if someone else adds a new wallet address to their account. This is because the new address won't show up in Wc, and you can only see it through the Fc API (like @neynar). This could happen if someone uses a bot script to scan accounts in real-time based on their sequential FID. Until this gets fixed, just make sure to double-check your verified addresses list at least 20 minutes after adding a new address to your Wc using neynar.

I'm eth newbie..just learning
(working on @farcaster)

terminally.online

best farcaster developers build on neynar.com | /neynar

2mo ago, Ive reached out to @horsefacts.eth about a security issue on 'Verified Addresses', but it looks like there's still no update. The thing is, users might not even notice if someone else adds a new wallet address to their account. This is because the new address won't show up in Wc, and you can only see it through the Fc API (like @neynar). This could happen if someone uses a bot script to scan accounts in real-time based on their sequential FID. Until this gets fixed, just make sure to double-check your verified addresses list at least 20 minutes after adding a new address to your Wc using neynar. https://warpcast.com/jacek/0x40c845cf

just for fun • security researcher • share my findings to bring security awareness • /dev /infosec /farcaster /bot

Palangkaraya, Jekan Raya, Palangka Raya City, Central Kalimantan, Indonesia

How can I programmatically check my verified address list? I haven't added an address since I first created my account.

In Wc you can navigate to settings>verified address, in neynar you can go to https://docs.neynar.com/reference/user-bulk put your FID and check

It's only one address. That's just an ENS name that maps to my address.