Coinbase Bug to Provide Unlimited Ethereum

The bug was found by VI Company in December last year
21 March 2018   964

VI Company reported the discovery of a vulnerability in the system of smart contracts of the Coinbase exchange, which allowed users to credit an unlimited amount of ETH to their accounts. Experts informed the company about the vulnerability in December last year, and in January it was eliminated. For their work, VI Company employees received an award of $ 10,000. This is reported by The Next Web.

By using a smart contract to distribute ether over a set of wallets you can manipulate the account balance of your Coinbase account. If 1 of the internal transactions in the smart contract fails all transactions before that will be reversed. But on Coinbase these transactions will not be reversed, meaning someone could add as much ether to their balance as they want. When you look up the Coinbase wallet address after this transaction you will see that it is empty, but checking your Coinbase wallet will show your funds.
 

VI Company Report

In practice, this means that Coinbase users were able to enroll any amount of Ethereum on their accounts.

Researchers provided screenshots showing how Ethereum was credited to their account using the cancellation of the transaction.

Coinbase Bug
Coinbase Bug

Steps to reproduce, provided by the researchers :

  • Setup a smart contract with a few valid Coinbase wallets and 1 final faulty wallet (always throw exception when receiving funds smart contract for example)
  • Transfer appropriate funds to smart contract.
  • Execute smart contract adding the set amount of ether to the Coinbase wallets without ever actually leaving the smart contract wallet because the complete transaction fails at the last wallet.
  • Repeat until you have more than enough ethereum in your Coinbase wallet.
  • Cash out, transfer to off site wallet.

Whether any of the users could detect and take advantage of this vulnerability for their own enrichment is unknown.

Coinbase to Launch Services for Newbie Traders

Coinbase Bundle, Coinbase Asset Pages and Coinbase Learn are designed to "help people understand, explore, and buy their first cryptocurrency"
28 September 2018   367

The leading US cryptocurrency exchange Coinbase, has introduced several services for novice users.

Coinbase Bundle allows to invest in several crypto assets, including Bitcoin, Bitcoin Cash, Ethereum, Ethereum Classic and Litecoin. At the same time, the specific weight of each currency in the user's portfolio is formed in accordance with the share of these assets in the market. The minimum investment in the Bundle is only $ 25.

Coinbase Bundle Service
Coinbase Bundle Service

The update is positioned by Coinbase as a convenient tool to acquire all five of the listed cryptocurrencies without having to create a separate order for each coin.

The platform will be used by users of the platform from the US, EU countries and Great Britain. The commission for the acquisition of Bundle is 1.5%.

Also, the company introduced the Coinbase Asset Pages service, which displays information on 50 leading crypto-currencies, including their market capitalization, the current price and its changes, as well as links to relevant information sources.

Coinbase Asset Pages
Coinbase Asset Pages

Coinbase Asset Pages is available to everyone and is not limited to the user base of the company.

In addition, the company introduced the educational service Coinbase Learn, designed to familiarize users with the basics of working with crypto-currencies.