Coinbase — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Coinbase, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 3
- Total paid
- $100
- Critical
- 0
- Largest payout
- $100
This page collects the 3 closed, publicly disclosed Coinbase reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity, Other. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Coinbase
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Window.opener bug at www.coinbase.com
A web application link on www.coinbase.com opened external URLs using target="_blank" without setting the rel="noopener" or rel="noreferrer" security attributes. This allowed the newly opened destination window to access and manipulate the parent tab through the JavaScript window.opener reference. An attacker controlling the external target site could leverage this access to redirect the user's active Coinbase tab to a malicious external URL or phishing page. Coinbase rewarded the finding with a $100 bounty.
Coinbase: Balance check during `MagicSpend` validation cannot ensure that `MagicSpend` has enough balance to cover the requested fund
Coinbase's MagicSpend paymaster validated a balance check against address(this).balance during the EntryPoint's validation loop, but since all userOps in a bundle are validated before any are executed, several withdrawals in one bundle can each pass validation against the pre-execution balance and collectively exceed the contract's actual ETH. The confirmed finding shows a bundle of two withdrawals (100 + 150) passing validation when the contract holds only 200, causing the second postOp transfer to revert and leaving the bundle's withdrawals unfulfilled. The protocol confirmed the guard is not fully satisfactory and mitigated by giving the owner a configurable maxWithdrawDenominator to probabilistically bound withdrawal sizes, while acknowledging bundlers can be griefed through the paymaster's reputation.
Coinbase: Remove owner calls can be replayed to remove a different owner at the same index, leading to severe issues when combined with lack of last owner guard
The Coinbase Smart Wallet stores its owner list per chain and permits owner mutations through ERC-4337 EntryPoint calls whose signatures omit chainId validation, making them replayable across every chain where the wallet is deployed. Because the same ownership index can map to different addresses on different chains, a signature calling removeOwnerAtIndex can be replayed to delete whichever owner that index points to on each chain, potentially deleting the only accessible owner and permanently locking the account. The judge confirmed the sponsor's acknowledgement of issue #57, upgraded the finding to High, and the sponsor mitigated it by adding an owner argument to removeOwnerAtIndex and reverting when it does not match the address at the index, in coinbase/smart-wallet PR #42.