Coinbase · Report #126784
Sending payments via QR code does not require confirmation
Summary
Coinbase pushed out a feature whereby scanning a QR code inside the Coinbase Mobile app would complete payments under 0.1BTC without further confirmation.
Upon reviewing this report and further consideration of the possible security implications of this feature, it was reverted.
This issue has a disclosure location at https://www.reddit.com/r/Bitcoin/comments/4g0f1l/bad_qr_coinbase_mobile_wallet_social_engineering/
I will updating that thread the moment builds for mobile apps are published on the App Stores for Android and iOS
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.