Jaw-dropping Coinbase security bug allowed users to steal unlimited cryptocurrency

Researcher nets $250,000 for ‘potentially market-nuking’ vulnerability

A security researcher has netted a $250,000 bug bounty for disclosing a vulnerability in Coinbase that could have allowed a user to ‘sell’ currency they did not own.

The bug was spotted by security engineer ‘Tree of Alpha’, whose disclosure led to them receiving the cryptocurrency exchange’s biggest ever bounty payout this month.

Alpha discovered that they were able to trade cryptocurrency that wasn’t theirs due to a missing logic validation check in a Retail Brokerage API endpoint, which allowed a user to submit trades to a specific order book using a mismatched source account.

This could have potentially allowed an attacker to steal unlimited cryptocurrency from the platform.

Trading places

A blog post from Coinbase describes the attack: “A user has an account with 100 SHIB, and a second account with 0 BTC.

“The user submits a market order to the BTC-USD order book to sell 100 BTC, but manually edits their API request to specify their SHIB account as the source of funds.

“Here, the validation service would check to determine whether the source account had a sufficient balance to complete the trade, but not whether the source account matched the proposed asset for submitting the trade.

“As a result, a market order to sell 100 BTC on the BTC-USD order book would be entered on the Coinbase Exchange.”

‘Potentially market-nuking’

Alpha described on Twitter how they used 0.0243 ETH to sell 0.0243 BTC on the BTC-USD pair, “a pair I do not have access to, without holding any BTC”.

They continued: “Hoping this is a UI bug, I check the fills on the order, and they match the API: those trades really happened, on the live order book.”

On discovering the issue, Alpha reported the bug to the Coinbase bug bounty program, managed by HackerOne.

They also took to Twitter to find a contact at Coinbase, to warn them of the “potentially market-nuking” discovery.

Emergency fix

Impressively, Coinbase responded and the bug was fixed in less than six hours, with the exchange “conclusively determining” that it had never been maliciously exploited.

The blog post continues: “This API is only utilized by our Retail Advanced Trading platform, which is currently in limited beta release.

“There were mitigating factors that would have limited the impact of this flaw had it been exploited at scale.

“For example, Coinbase Exchange has automatic price protection circuit breakers, and our trade surveillance team continuously monitors our markets for health and anomalous trading activity.

“Thanks to the researcher who responsibly disclosed this issue, Coinbase was able to fix this bug in a matter of hours, and conclusively determine that it has never been maliciously exploited.

“We have also implemented additional checks to ensure that it cannot happen again.”

Payday

Alpha was awarded $250,000, the highest payout from Coinbase to date, though the potential amount of funds lost if the vulnerability was exploited pales in comparison.

The Daily Swig has reached out to the security researcher for more comment.