[BreachExchange] Jaw-dropping Coinbase security bug allowed users to steal unlimited cryptocurrency

[Terrell Byrd]

https://portswigger.net/daily-swig/jaw-dropping-coinbase-security-bug-allowed-users-to-steal-unlimited-cryptocurrency

A security researcher has netted a $250,000 bug bounty for disclosing a
vulnerability in Coinbase that could have allowed a user to ‘sell’ currency
they did not own.

The bug was spotted by security engineer ‘Tree of Alpha’, whose disclosure
led to them receiving the cryptocurrency exchange’s biggest ever bounty
payout this month.

Alpha discovered that they were able to trade cryptocurrency that wasn’t
theirs due to a missing logic validation check in a Retail Brokerage API
endpoint, which allowed a user to submit trades to a specific order book
using a mismatched source account.

This could have potentially allowed an attacker to steal unlimited
cryptocurrency from the platform.

Trading places
A blog post from Coinbase describes the attack: “A user has an account with
100 SHIB, and a second account with 0 BTC.

“The user submits a market order to the BTC-USD order book to sell 100 BTC,
but manually edits their API request to specify their SHIB account as the
source of funds.

“Here, the validation service would check to determine whether the source
account had a sufficient balance to complete the trade, but not whether the
source account matched the proposed asset for submitting the trade.

“As a result, a market order to sell 100 BTC on the BTC-USD order book
would be entered on the Coinbase Exchange.”

‘Potentially market-nuking’
Alpha described on Twitter how they used 0.0243 ETH to sell 0.0243 BTC on
the BTC-USD pair, “a pair I do not have access to, without holding any BTC”.

They continued: “Hoping this is a UI bug, I check the fills on the order,
and they match the API: those trades really happened, on the live order
book.”

On discovering the issue, Alpha reported the bug to the Coinbase bug bounty
program, managed by HackerOne.

They also took to Twitter to find a contact at Coinbase, to warn them of
the “potentially market-nuking” discovery.

Emergency fix
Impressively, Coinbase responded and the bug was fixed in less than six
hours, with the exchange “conclusively determining” that it had never been
maliciously exploited.

The blog post continues: “This API is only utilized by our Retail Advanced
Trading platform, which is currently in limited beta release.

“There were mitigating factors that would have limited the impact of this
flaw had it been exploited at scale.

“For example, Coinbase Exchange has automatic price protection circuit
breakers, and our trade surveillance team continuously monitors our markets
for health and anomalous trading activity.

“Thanks to the researcher who responsibly disclosed this issue, Coinbase
was able to fix this bug in a matter of hours, and conclusively determine
that it has never been maliciously exploited.

“We have also implemented additional checks to ensure that it cannot happen
again.”

Payday
Alpha was awarded $250,000, the highest payout from Coinbase to date,
though the potential amount of funds lost if the vulnerability was
exploited pales in comparison.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20220222/6b8acc44/attachment.html>