Warpcast

Still no update yet!

I came across a similar vulnerability related to this and I'm planning to test a real exploit tomorrow. I'll be able to show you how to steal your assets. Today, I'm working on creating an exploit bot to run on my vps.

https://dune.com/queries/4078976: If your asset was stolen by these address, it'll be sent back once the issue gets fixed. Don't worry!

builder, realized the issue? DC me for the details issue to fix!

Hey everyone, 
as I mentioned earlier since its still not update yet. Today, I simulated a real bot attack to target degen.mint.club (@mcdegen), which had the same issue as @warpcast. It affected 47 users and resulted in 279,695 swapped $degen. I'll send out refunds ASAP, hopefully by tomorrow, according to the list here (https://dune.com/queries/4083858).

Based on this, I think it's clear that @warpcast will be more vulnerable to this issue. Pls help me prioritize fixing it ASAP!

cc: @dwr.eth @undefined @jacek @mcdegen

full sack developer intern at /farcards /mintclub warpcast.tools 🔫 my code breaks things :( 


Tip $DEGEN to mint tokens on degen.mint.club 🎩

just for fun • security researcher • share my findings to bring security awareness • /dev /infosec /farcaster /bot

Palangkaraya, Jekan Raya, Palangka Raya City, Central Kalimantan, Indonesia

I am on your list. Can you explain the nature of the issue?

Farcaster

I decide to public this info/report
dear cc @dwr.eth @warpcast 

I've discovered an issue on Warpcast that allows someone to bind wallet address to any others without being authorized.

Affected:
- Warpcast Web
- Warpcast App (send email link)

Simple explanation for reproduce:
When you click the button to verify your wallet on either of these affected services, it grants public authorization for a limited time. During this period, malicious actors can bind their wallet address to your Warpcast using your FID.

Impact: 
This could replace your recipient's address for any transactions on Farcaster, including airdrops (degen, ham, etc..).

I changed ur primary address on degen.mint.club, the same issue on warpcast read here https://warpcast.com/0xsec.eth/0x5b7cbef7

frame developer, web3 developer, long distance runner /pixelnouns /frm /degendogs /degenfers /toka /maxis