At Coinbase, our number one priority is ensuring that we uphold our security commitments to our customers. On February 11, 2022, we received a report from a third-party researcher indicating that they had uncovered a flaw in Coinbase’s trading interface. We promptly mobilized our security incident response team to identify and patch the bug, and resolved the underlying system issue without any impact to customer funds.
This blog post provides a deeper look into the timeline of events surrounding the bug report, as well as an explanation of the bug itself and the steps we took to resolve it and ensure it cannot happen again.
Timeline
(note, all events occurred on February 11, 2022, and all times are in PST)
- 10:16 AM: A member of the crypto community tweets that they have uncovered a serious flaw in the Coinbase trading interface, and requests contacts in the Coinbase Security team.
- 11:00 AM: Based on limited initial information provided by intermediaries, Coinbase Security declares an incident and mobilizes engineering resources to begin testing all trading interfaces to determine the validity of the alleged bug.
- 11:21 AM: The crypto researcher files a vulnerability report via HackerOne, Coinbase’s bug bounty platform, indicating that the flaw resides in a specific API for Retail Advanced Trading. Coinbase engineers also complete a review of all other user interfaces and Coinbase Exchange APIs and determine that they are not impacted.
- 11:42 AM: Coinbase engineers are able to reproduce the bug, and the Retail Advanced Trading platform is placed into cancel-only mode, disabling new trades.
- 4:01 PM: A patch is validated and released, resolving the incident.
Root Cause
The underlying cause of the bug was a missing logic validation check in a Retail Brokerage API endpoint, which allowed a user to submit trades to a specific order book using a mismatched source account. This API is only utilized by our Retail Advanced Trading platform, which is currently in limited beta release.
To give an example:
- A user has an account with 100 SHIB, and a second account with 0 BTC.
- The user submits a market order to the BTC-USD order book to sell 100 BTC, but manually edits their API request to specify their SHIB account as the source of funds.
- Here, the validation service would check to determine whether the source account had a sufficient balance to complete the trade, but not whether the source account matched the proposed asset for submitting the trade.
- As a result, a market order to sell 100 BTC on the BTC-USD order book would be entered on the Coinbase Exchange.
There were mitigating factors that would have limited the impact of this flaw had it been exploited at scale. For example, Coinbase Exchange has automatic price protection circuit breakers, and our trade surveillance team continuously monitors our markets for health and anomalous trading activity.
Conclusion
Thanks to the researcher who responsibly disclosed this issue, Coinbase was able to fix this bug in a matter of hours, and conclusively determine that it has never been maliciously exploited. We have also implemented additional checks to ensure that it cannot happen again.
Coinbase strongly supports independent security research, and when those researchers uncover serious issues, we want to ensure that they are rewarded accordingly. As a result, we are paying our largest-ever bug bounty for this finding: $250,000.
We welcome future submissions from this researcher and others via our HackerOne program: https://hackerone.com/coinbase.
Retrospective: Recent Coinbase Bug Bounty Award was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
Check live crypto rates here
Start trading today – See our list of exchanges
Howdy would you mind letting me know which hosting company you’re working with? I’ve loaded your blog in 3 different internet browsers and I must say this blog loads a lot faster then most. Can you recommend a good hosting provider at a honest price? Thanks a lot, I appreciate it!
It’s hard to find knowledgeable people on this topic, but you sound like you know what you’re talking about! Thanks
Its such as you learn my mind! You seem to grasp so much about this, such as you wrote the e-book in it or something. I believe that you just can do with some percent to force the message house a little bit, but instead of that, this is excellent blog. An excellent read. I’ll definitely be back.
order fosamax 35mg sale generic fosamax 70mg famotidine canada
fosamax 70mg price order panadol 500 mg generic pepcid 20mg drug
I’m truly enjoying the design and layout of your site. It’s a very easy on the eyes which makes it much more pleasant for me to come here and visit more often. Did you hire out a designer to create your theme? Excellent work!
I really like your blog.. very nice colors & theme. Did you make this website yourself or did you hire someone to do it for you? Plz answer back as I’m looking to design my own blog and would like to know where u got this from. appreciate it
I like this post, enjoyed this one thanks for putting up. “We seldom attribute common sense except to those who agree with us.” by La Rochefoucauld.
Great beat ! I wish to apprentice at the same time as you amend your website, how could i subscribe for a blog website? The account helped me a applicable deal. I had been tiny bit acquainted of this your broadcast offered vibrant clear idea
I’ve been exploring for a bit for any high-quality articles or blog posts in this sort of area . Exploring in Yahoo I ultimately stumbled upon this web site. Reading this info So i’m glad to express that I have an incredibly excellent uncanny feeling I discovered exactly what I needed. I so much without a doubt will make sure to don’t forget this website and provides it a look on a continuing basis.
Some truly good information, Glad I observed this.
The next time I read a weblog, I hope that it doesnt disappoint me as a lot as this one. I imply, I do know it was my choice to learn, but I actually thought youd have one thing interesting to say. All I hear is a bunch of whining about something that you would fix if you werent too busy searching for attention.
An outstanding share! I have just forwarded this onto a colleague
who had been doing a little research on this. And he in fact bought me breakfast
simply because I discovered it for him… lol. So let me reword this….
Thanks for the meal!! But yeah, thanks for spending the time to talk about
this subject here on your internet site.
Great awesome things here. I?¦m very happy to see your post. Thanks so much and i am looking ahead to contact you. Will you please drop me a mail?