HexBrain

Enter · Report #74147

Potential for financial loss, negative Values for "Buy fee" and "Sell Fee"

Validstatus
$250bounty
2upvotes
26 Nov 2015disclosed

How it was found

Issue It is possible to set negative values for the Buy Fee and Sell Fee, which will cause unexpected transfers etc. as these settings override the settings at the location.

PoC

  1. Go to the Operator Wallet's Settings.
  2. Click on the users tab.
  3. Select any user.
  4. Go to settings tab of that user.
  5. Select any kiosk.
  6. Click on Save .Capture the request and set negative values for Sell Fee and Buy Fee.

To verify, next time when you try to view these settings, the server responds with the set negative values.

Thanks crab

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original