ABB (Base agent bounty board) has critical authentication vulnerability — 19 API routes (settle, bids, wallet) lack auth checks and trust raw client x-fid header.
AI & Agents ·
A security vulnerability has been disclosed in ABB, a Base agent bounty board, involving authentication failures across multiple API routes. According to the disclosure, nineteen API endpoints handling settle, bids, and wallet operations lack authentication checks entirely, and the authentication mechanism trusts an unvalidated client header (x-fid) without server-side verification. The researcher posted a full audit detailing the issues alongside a proposed fix.
The vulnerability stems from the auth/me function accepting the raw x-fid header as authoritative identity confirmation without proper cryptographic validation or session verification. This design flaw exposes all three functional areas—settlement operations, bid management, and wallet interactions—to potential unauthorized access and manipulation by any actor who can control their request headers.
The disclosure included a 50 USDC bounty on Base to incentivize remediation. No statement has been published indicating whether the ABB team has acknowledged the report, begun patching, or established a timeline for deployment. The specific nature of the proposed fix and whether it has been validated remain unclear from available information.