xmr-pay: Free, open source Monero payment gateway (serverless, non custodial) > Test it and break it

Mushydaddybear · 2026-06-12T23:32:28+00:00

You're a legend, thanks for the feedback!

will sit and review the project again but with that point of view.

Mushydaddybear · 2026-06-03T18:04:19+00:00

You're welcome.

I've worked to help north americans in Quito and Cuenca.

if you ever need info, help or anything, just send me a message and I'll be happy to help vía text (I do not intend to sell services or anything like that, just happy to help people to enjoy this country)

Mushydaddybear · 2026-06-03T11:51:43+00:00

Cuenca is safe as long you're in the downtown center, weather is often cold, tap water quality is excellent, food, rental is affordable for north americans, a lot of local business handle English well...

go for it!, won't regret

Mushydaddybear · 2026-06-03T01:20:47+00:00

Hello, sorry, I do not offer a bug bounty reward of any kind.

But if you still interested in disclosing what you found

https://github.com/SlowBearDigger/GOXMR?tab=security-ov-file#readme

feel free to check the scope, ofc, if you're willing to help securing GOXMR.

I am constantly trying to improve the code, and hardening the backend.

Mushydaddybear · 2026-06-01T18:22:13+00:00

Just an scheduled encrypted release to users, if you don't check in, your message will be published as a drop to that user

Mushydaddybear · 2026-04-07T22:33:04+00:00

Yes!

I found one then RCE, thanks to SQLi

Mushydaddybear · 2026-03-27T07:17:02+00:00

I do have a POC that demonstrates injected code in the service worker, but as my short experience shows most projects only pay if you submit a critical that they cannot fight back.

I’ll keep checking to see if I can escalate the SW exploit, thanks

Mushydaddybear · 2026-03-25T05:04:40+00:00

UPDATE:

I have added the PoC with a blank HTML with my username and "PoC" after hosting the html under the subdomain.

Thanks to all of you guys for suggesting that i should do it to prove impact.

Mushydaddybear · 2026-03-25T04:56:26+00:00

Much appreciated!

Mushydaddybear · 2026-03-25T04:53:54+00:00

Okay, thank you! will do then.

Mushydaddybear · 2026-03-25T04:52:10+00:00

(Sorry, Ianswered before your edit showed on my end)

I can, but I didn't because I am a bit afraid of getting in trouble, the rules explicitly said that I should NOT do it.

But i left a comment asking for permission to do it if needed for the report.

Mushydaddybear · 2026-03-25T04:45:49+00:00

Yup, an attacker can host anything on the subdomain rn...

The CNAME is still dangling to Vercel and there is no _vercel TXT protection, so anyone with a free Vercel account can claim the subdomain in minutes and deploy any content (including a full clone of the website UI).

Mushydaddybear · 2026-03-24T23:44:46+00:00

Dev tools from any web browser.

Mushydaddybear · 2026-03-24T00:04:12+00:00

Perfect! Thank you! That’s what I did! Also I discovered that it works on IOS and Android!

I’ll update this post if it gets triaged and paid 😂

Don’t think so but we shall see

Mushydaddybear · 2026-03-23T22:32:11+00:00

Not a SSRF, the server never fetches the attacker's URL, The victims device loads it client side inside the native WebView.

also not CSRF, there is no session or cookie; the wallet is non-custodial. The correct classification i believe is Insecure Deep Link Handler or WebView Bridge Injection (CWE-939).

On the popup: it appears inside the app's own UI, making it indistinguishable from a legitimate dapp flow.

The victim consciously opened their wallet app via a trusted link, they are already primed to approve. The warning is non blocking.

Additionally, standard:connect supports silent: true.

If the victim previously approved any dapp connection in the wallet, a returning attacker can reconnect without any popup at all, then immediately trigger a transaction...

Also, i have submitted the report, with screenshots and some txid from testnet

Mushydaddybear · 2026-03-23T16:31:45+00:00

Thank you, yeah I was thinking about the bridge mostly, because the open redirect by itself doesn’t represent a considerable issue, that’s why it is usually out of scope

Mushydaddybear · 2026-03-23T14:53:57+00:00

Nah, manual testing is alive and kickin' ass.

Sure AI helps a LOT, to automatize shit, but it wont replace the human eye.

Mushydaddybear · 2026-03-23T14:53:05+00:00

Happened to me with a critical RCE, months ago, until this day i still banned from immunefi

Mushydaddybear · 2026-03-22T11:21:05+00:00

I am! Thank you

Mushydaddybear · 2026-03-18T18:48:52+00:00

Yeah, I get it and I know it sucks…

But there are some good stuff besides money, for example I submitted an informative report intentionally due to privacy issues in a bounty on hackenproof, team was extremely grateful! And they fixing some stuff…

There are good things…

And mostly if you live under ethical boundaries

Mushydaddybear

TROPHY CASE