{"id":647,"date":"2022-03-14T18:21:09","date_gmt":"2022-03-14T18:21:09","guid":{"rendered":"https:\/\/grandpascrypto.com\/?p=647"},"modified":"2022-03-14T18:21:11","modified_gmt":"2022-03-14T18:21:11","slug":"coinbases-infinite-money-printing-bug","status":"publish","type":"post","link":"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/","title":{"rendered":"Coinbase\u2019s Infinite Money Printing Bug"},"content":{"rendered":"\n<p><strong><em>tl;dr Summary<\/em><\/strong><em>: Coinbase awards their largest bug bounty yet of $250,000 for an infinite money printing bug.<\/em><\/p>\n\n\n\n<p>The term \u201chacker\u201d normally carries a negative connotation. Hackers are often synonymous with cyber criminals who use their expert-level proficiency in information technology and computer programming with malicious intent. However, not all hackers are looking to steal your hard earned money. Cybersecurity researchers and penetration testers are examples of hackers that use their ability for good. Software companies often offer thousands of dollars in bounty reward payments to such hackers who find errors or bugs in their software which could be exploited by a malicious user.&nbsp;<\/p>\n\n\n\n<p>One such bug bounty reward was given to a software engineer and trader known on twitter as <a href=\"https:\/\/twitter.com\/Tree_of_Alpha\/status\/1495014902582362112\">Tree_of_Alpha<\/a>. Coinbase, largest cryptocurrency exchange in the United States by trading volume, recently awarded the researcher <a href=\"https:\/\/blog.coinbase.com\/retrospective-recent-coinbase-bug-bounty-award-9f127e04f060\">$250,000 for finding a bug<\/a> which could have been exploited to print infinite sums of money and wreak havoc to the cryptocurrency market.\u00a0<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">Coinbase&#39;s &quot;largest-ever bug bounty&quot;<br><br>How a flaw in the new Advanced Trading feature would have allowed a malicious user to sell BTC or any other coin without owning them, and how Coinbase&#39;s reaction speed on a Super Bowl Friday averted a possible crisis.<br><br>Bounty: $250,000 <a href=\"https:\/\/t.co\/Y91M48pCcI\">pic.twitter.com\/Y91M48pCcI<\/a><\/p>&mdash; Tree of Alpha (@Tree_of_Alpha) <a href=\"https:\/\/twitter.com\/Tree_of_Alpha\/status\/1495014902582362112?ref_src=twsrc%5Etfw\">February 19, 2022<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>Coinbase recently launched an <a href=\"https:\/\/blog.coinbase.com\/bringing-advanced-trading-tools-to-coinbase-1fd5a590113b\">Advanced Trade<\/a> option on their platform which gives users <a href=\"https:\/\/help.coinbase.com\/en\/coinbase\/trading-and-funding\/advanced-trading\/what-is-advanced-trading\">advanced tools<\/a> for trading cryptocurrency. This new feature allows Coinbase users to make limit orders, stop-loss orders, and even stake cryptocurrencies like Ethereum and Tezos. Before fully releasing this feature to the public, Coinbase had released a beta version to a limited number of users for testing. The cybersecurity researcher who found the bug was initially trying to understand how orders were sent on this feature and what a successful order looked like. The user did this by examining the Application Programming Interface (API), which is the software that connects Coinbase\u2019s platform with a cryptocurrency orderbook, an electronic list of an asset&#8217;s buy and sell activity.&nbsp;<\/p>\n\n\n\n<p>The user identified that for a successful trade order to be submitted the API requires a product ID for the asset being bought or sold (e.g. BTC-USD, ETH-USD, etc.) and the wallet addresses of both parties in the trade. In order to test their hypothesis, the user created two crypto wallets:&nbsp;<\/p>\n\n\n\n<p>one containing Ethereum (ETH) and one containing Euros (EUR). The user then created an order from the wallet to sell 0.0234 ETH to the wallet containing EUR. Before submitting, the user modified the product ID in the API from \u201cETH-EUR\u201d to \u201cBTC-USD\u201d. The user expected to see an error message since neither wallet had any Bitcoin. However, the order went through and they had successfully used 0.0234 ETH (~$60) to sell 0.0234 BTC (~$890).&nbsp;<\/p>\n\n\n\n<p>The user tested this bug again using a different cryptocurrency. This time they were able to use 50 SHIB, worth about 1\/10th of a penny, to create a 50 BTC limit-sell order by simply changing the product ID in the API code from \u201cSHIB-USD\u201d to \u201cBTC-USD\u201d. After verifying that this sell order was live on Coinbase\u2019s platform the user immediately submitted a report to HackerOne.com, a bug bounty platform that connects businesses with penetration testers and cybersecurity researchers. Coinbase promptly responded to the report, paused trading on their Advanced Trade platform and resolved the bug in about 4 hours.<\/p>\n\n\n\n<p>Hypothetically, had this been a malicious hacker who found the bug, a limit-sell order could be created using 50 SHIB (~$0.001) with a sale price of $50,000. The product ID could then be manipulated to display a limit-sell order of 50 BTC for $50,000. A buyer would then come along fully believing they had bought $1.9 million worth of Bitcoin for just $50,000. The hacker could then withdraw their profits from their Coinbase account into their bank account, essentially creating money out of thin air.&nbsp;<\/p>\n\n\n\n<p>To Coinbase\u2019s credit, they likely would have been able to mitigate the damage this bug would have caused. In their <a href=\"https:\/\/blog.coinbase.com\/retrospective-recent-coinbase-bug-bounty-award-9f127e04f060\">retrospective analysis<\/a>, Coinbase noted:<\/p>\n\n\n\n<p>\u201cThere were mitigating factors that would have limited the impact of this flaw had it been exploited at scale. For example, Coinbase Exchange has automatic price protection circuit breakers, and our trade surveillance team continuously monitors our markets for health and anomalous trading activity.\u201d<\/p>\n\n\n\n<p>Luckily Coinbase users never have to worry about this possibility because a hacker with good intentions was able to spot the problem and contact the right people to get the bug resolved quickly.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Coinbase awards their largest bug bounty yet of $250,000 for an infinite money printing bug.<\/p>\n","protected":false},"author":2,"featured_media":648,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[54],"tags":[72,281,79,285,136,283,68,282,284,286],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v18.1 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Coinbase\u2019s Infinite Money Printing Bug - grandpascrypto.com\" \/>\n<meta property=\"og:description\" content=\"Coinbase awards their largest bug bounty yet of $250,000 for an infinite money printing bug.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/\" \/>\n<meta property=\"og:site_name\" content=\"grandpascrypto.com\" \/>\n<meta property=\"article:published_time\" content=\"2022-03-14T18:21:09+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-03-14T18:21:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/03\/Coinbase-money-printing.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Basil\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/grandpascrypto.com\/#website\",\"url\":\"https:\/\/grandpascrypto.com\/\",\"name\":\"grandpascrypto.com\",\"description\":\"Crypto explained so well that your grandpa can understand\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/grandpascrypto.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/#primaryimage\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/03\/Coinbase-money-printing.png\",\"contentUrl\":\"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/03\/Coinbase-money-printing.png\",\"width\":1280,\"height\":720},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/#webpage\",\"url\":\"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/\",\"name\":\"Coinbase\u2019s Infinite Money Printing Bug - grandpascrypto.com\",\"isPartOf\":{\"@id\":\"https:\/\/grandpascrypto.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/#primaryimage\"},\"datePublished\":\"2022-03-14T18:21:09+00:00\",\"dateModified\":\"2022-03-14T18:21:11+00:00\",\"author\":{\"@id\":\"https:\/\/grandpascrypto.com\/#\/schema\/person\/378187240e6d6d5198a7f2b09034b1f0\"},\"breadcrumb\":{\"@id\":\"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/grandpascrypto.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Coinbase\u2019s Infinite Money Printing Bug\"}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/grandpascrypto.com\/#\/schema\/person\/378187240e6d6d5198a7f2b09034b1f0\",\"name\":\"Raul Chacon\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/grandpascrypto.com\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":{\"url\":\"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/02\/Raul.jpg\",\"url2x\":\"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/02\/Raul.jpg\"},\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3d76631a60bf1a7fbc3039e3cd1d1aa6?s=96&d=mm&r=g\",\"caption\":\"Raul Chacon\"},\"url\":\"https:\/\/grandpascrypto.com\/author\/raul-chacon\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/","og_locale":"en_US","og_type":"article","og_title":"Coinbase\u2019s Infinite Money Printing Bug - grandpascrypto.com","og_description":"Coinbase awards their largest bug bounty yet of $250,000 for an infinite money printing bug.","og_url":"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/","og_site_name":"grandpascrypto.com","article_published_time":"2022-03-14T18:21:09+00:00","article_modified_time":"2022-03-14T18:21:11+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/03\/Coinbase-money-printing.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Written by":"Basil","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/grandpascrypto.com\/#website","url":"https:\/\/grandpascrypto.com\/","name":"grandpascrypto.com","description":"Crypto explained so well that your grandpa can understand","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/grandpascrypto.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/#primaryimage","inLanguage":"en-US","url":"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/03\/Coinbase-money-printing.png","contentUrl":"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/03\/Coinbase-money-printing.png","width":1280,"height":720},{"@type":"WebPage","@id":"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/#webpage","url":"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/","name":"Coinbase\u2019s Infinite Money Printing Bug - grandpascrypto.com","isPartOf":{"@id":"https:\/\/grandpascrypto.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/#primaryimage"},"datePublished":"2022-03-14T18:21:09+00:00","dateModified":"2022-03-14T18:21:11+00:00","author":{"@id":"https:\/\/grandpascrypto.com\/#\/schema\/person\/378187240e6d6d5198a7f2b09034b1f0"},"breadcrumb":{"@id":"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/grandpascrypto.com\/coinbases-infinite-money-printing-bug\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/grandpascrypto.com\/"},{"@type":"ListItem","position":2,"name":"Coinbase\u2019s Infinite Money Printing Bug"}]},{"@type":"Person","@id":"https:\/\/grandpascrypto.com\/#\/schema\/person\/378187240e6d6d5198a7f2b09034b1f0","name":"Raul Chacon","image":{"@type":"ImageObject","@id":"https:\/\/grandpascrypto.com\/#personlogo","inLanguage":"en-US","url":{"url":"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/02\/Raul.jpg","url2x":"https:\/\/grandpascrypto.com\/wp-content\/uploads\/2022\/02\/Raul.jpg"},"contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3d76631a60bf1a7fbc3039e3cd1d1aa6?s=96&d=mm&r=g","caption":"Raul Chacon"},"url":"https:\/\/grandpascrypto.com\/author\/raul-chacon\/"}]}},"authors":[{"term_id":160,"user_id":0,"is_guest":1,"slug":"raul-chacon","display_name":"Raul Chacon"}],"_links":{"self":[{"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/posts\/647"}],"collection":[{"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/comments?post=647"}],"version-history":[{"count":1,"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/posts\/647\/revisions"}],"predecessor-version":[{"id":649,"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/posts\/647\/revisions\/649"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/media\/648"}],"wp:attachment":[{"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/media?parent=647"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/categories?post=647"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/grandpascrypto.com\/wp-json\/wp\/v2\/tags?post=647"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}