[Eco Bounty] ioPay Missing Validation for Self-Transfer

Summary

The wallet allows a user to input their own current wallet address as the "Receiver" for a token transfer. This leads to a "Self-Transfer" which costs the user transaction (gas) fees while essentially doing nothing. Most modern wallets include a validation check that prevents a user from sending to the sender address to avoid accidental fee loss.

Steps to Reproduce

  1. Open the ioPay wallet.

  2. Navigate to the Send screen.

  3. Select a network (e.g., Polygon) and a token (e.g., POL).

  4. In the Receiver field, select the address of the currently active wallet (either by pasting or selecting from the "My wallet" address book tab).

  5. Enter an amount and proceed.

Expected Result

The app should display an error message such as "Sender and Receiver addresses cannot be the same" or "You cannot send tokens to your own address" and disable the "Next" button.

Actual Result

The app accepts the address (shows a green checkmark) and allows the user to proceed with the transaction, potentially leading to a loss of gas fees.

A quick note on why this matters

In the crypto world, sending to yourself isn't "illegal" on the blockchain level, but it is considered a UX failure. Since you are paying a miner fee to send tokens from Address A back to Address A, you end up with slightly less money than you started with. Most wallets block this to protect you from a "facepalm" moment!

Wallet Address: io1tkw393kejmxwnd454twc6020sxcyvh5dxqmren

Device & Environment:

-Operating system: Android 13

-Device model: Redmi Note 10 Pro

Please authenticate to join the conversation.

Upvoters
Status

In Review

Board
πŸ’‘

New Issue

Date

26 days ago

Author

cryptotestnet

Subscribe to post

Get notified by email when there are changes.