HexBrain

Coinbase · Report #126784

Sending payments via QR code does not require confirmation

Validstatus
$1,000bounty
3upvotes
22 Apr 2016disclosed

Summary

Coinbase pushed out a feature whereby scanning a QR code inside the Coinbase Mobile app would complete payments under 0.1BTC without further confirmation.

Upon reviewing this report and further consideration of the possible security implications of this feature, it was reverted.

This issue has a disclosure location at https://www.reddit.com/r/Bitcoin/comments/4g0f1l/bad_qr_coinbase_mobile_wallet_social_engineering/

I will updating that thread the moment builds for mobile apps are published on the App Stores for Android and iOS

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original