Tree of Alpha user discovered a bug on Coinbase that could “undermine the market.”
Coinbase said the bug occurred in its new trading interface, available in limited beta testing mode. Users could manually change their APIs to sell a certain amount of cryptocurrency in one asset if they had the same amount in another.
“The user sends a market order to the BTC-USD order book to sell 100 BTC, but manually edits his API request to specify his account that has SHIB on it. As a result, a market order to sell 100 BTC in the BTC-USD order book will be placed on Coinbase Exchange,” the company said.
Tree of Alpha said it discovered a bug while poking around in the new Coinbase interface.
“I just used 0.0243 ETH to sell 0.0243 BTC in a BTC-USD pair that I have no access to without having any BTC. I was hoping it was a UI error, however, when I checked the order execution, the trades were indeed executed in the order book in real time,” he wrote.
In other words, Tree of Alpha was able to sell ~$1000 worth of bitcoin with only ~$70 worth of Ethereum in his account.
Coinbase said it would pay Tree of Alpha a modest $250000 in rewards.