[ECO Bounty] iopay No Early Detection for Malicious Scam Addresses

Description: I performed a security test to see if ioPay would trigger a warning when attempting to send funds to a known malicious scam address. Despite other wallets (like MetaMask or Rabby) often flagging high-risk addresses via third-party security APIs, ioPay allowed the transaction setup to proceed to the final confirmation screen without any visual warning or risk alert.

Steps to Reproduce:

  1. Open ioPay and select "Send."

  2. Input a known malicious/scam address (as identified in the attached screenshot).

  3. Enter an amount and proceed to the next screen.

  4. Observed Result: The wallet displays the standard transaction summary with no "High Risk" or "Scam Warning" banner.

  5. Expected Result: A prominent warning notification alerting the user that the recipient address has been flagged for malicious activity.

Supporting Evidence:

  • I have attached a screenshot showing the transaction screen with the suspicious address where no warning is present.

  • Note to Support: The address used in my test has been reported on several block explorers and scam databases.

Recommended Fix: Integrate a real-time security API (such as Scam Sniffer, GoPlus Security, or Hapi) to cross-reference recipient addresses against global blacklists before a user confirms a transaction.

Wallet Address: io1tkw393kejmxwnd454twc6020sxcyvh5dxqmren

Device & Environment:

-Operating system: Android 13

-Device model: Redmi Note 10 Pro

Please authenticate to join the conversation.

Upvoters
Status

In Review

Board
πŸ’‘

New Issue

Date

2 months ago

Author

cryptotestnet

Subscribe to post

Get notified by email when there are changes.