[Eco Bounty] ioPay Missing Validation for Self-Transfer
Summary
The wallet allows a user to input their own current wallet address as the "Receiver" for a token transfer. This leads to a "Self-Transfer" which costs the user transaction (gas) fees while essentially doing nothing. Most modern wallets include a validation check that prevents a user from sending to the sender address to avoid accidental fee loss.
Steps to Reproduce
Open the ioPay wallet.
Navigate to the Send screen.
Select a network (e.g., Polygon) and a token (e.g., POL).
In the Receiver field, select the address of the currently active wallet (either by pasting or selecting from the "My wallet" address book tab).
Enter an amount and proceed.
Expected Result
The app should display an error message such as "Sender and Receiver addresses cannot be the same" or "You cannot send tokens to your own address" and disable the "Next" button.
Actual Result
The app accepts the address (shows a green checkmark) and allows the user to proceed with the transaction, potentially leading to a loss of gas fees.
A quick note on why this matters
In the crypto world, sending to yourself isn't "illegal" on the blockchain level, but it is considered a UX failure. Since you are paying a miner fee to send tokens from Address A back to Address A, you end up with slightly less money than you started with. Most wallets block this to protect you from a "facepalm" moment!
Wallet Address: io1tkw393kejmxwnd454twc6020sxcyvh5dxqmren
Device & Environment:
-Operating system: Android 13
-Device model: Redmi Note 10 Pro
Log in to comment and vote
No comments yet
Be the first to share your thoughts.