[ECO Bounty] iopay No Early Detection for Malicious Scam Addresses

Description: I performed a security test to see if ioPay would trigger a warning when attempting to send funds to a known malicious scam address. Despite other wallets (like MetaMask or Rabby) often flagging high-risk addresses via third-party security APIs, ioPay allowed the transaction setup to proceed to the final confirmation screen without any visual warning or risk alert.

Steps to Reproduce:

  1. Open ioPay and select "Send."

  2. Input a known malicious/scam address (as identified in the attached screenshot).

  3. Enter an amount and proceed to the next screen.

  4. Observed Result: The wallet displays the standard transaction summary with no "High Risk" or "Scam Warning" banner.

  5. Expected Result: A prominent warning notification alerting the user that the recipient address has been flagged for malicious activity.

Supporting Evidence:

  • I have attached a screenshot showing the transaction screen with the suspicious address where no warning is present.

  • Note to Support: The address used in my test has been reported on several block explorers and scam databases.

Recommended Fix: Integrate a real-time security API (such as Scam Sniffer, GoPlus Security, or Hapi) to cross-reference recipient addresses against global blacklists before a user confirms a transaction.

Wallet Address: io1tkw393kejmxwnd454twc6020sxcyvh5dxqmren

Device & Environment:

-Operating system: Android 13

-Device model: Redmi Note 10 Pro

Please authenticate to join the conversation.

Upvoters
Status

In Review

Board
πŸ’‘

New Issue

Date

20 days ago

Author

cryptotestnet

Subscribe to post

Get notified by email when there are changes.