# Ethereum account balance manipulation

Coinbase credited ETH from failed contract internal transactions, letting a researcher inflate his balance by looping a reverting batch transfer.

- Payout: hidden
- Severity: critical
- Program: Coinbase
- Found by: vicompany
- Disclosed: 2018-03-21
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/300748
- Library page: https://bugbountylibrary.com/r/h1%3A300748
- Tags: area:web3 domain:web3 impact:funds-loss kind:bounty platform:hackerone sev:critical tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** ETH deposit crediting logic for contract-originated transfers
**Root cause:** Coinbase's ETH receiving code credited internal transactions from a contract even when the overall contract execution reverted, so reverted transfers were still booked as deposits.
**Steps:**
1. Deploy a smart contract that sends ETH to several valid Coinbase deposit addresses and finally to one faulty address whose receive function always throws.
2. Fund the contract with ETH.
3. Execute the batch send: all internal transfers including the Coinbase credits occur, then the final transfer reverts the whole transaction.
4. Coinbase still credits the earlier internal transfers to the deposit addresses while the on-chain contract balance is unchanged.
5. Repeat until the Coinbase balance is large, then cash out to an off-site wallet.
**How found:** Researcher reasoned about how Coinbase parses contract internal transactions versus EVM revert semantics, hypothesizing that a reverted batch would still be credited.
**Exploitation:** Attacker loops a self-reverting batch-transfer contract so each run credits ETH to his Coinbase account without any ETH leaving the contract; then withdraws the inflated balance off-platform.
**Escalation:** Repeatable loop allows unbounded balance inflation before cash-out.
**Insight:** When a custodian credits deposits from internal transactions, test whether it honors the parent transaction's revert status: a batch that fails on its last call still emits earlier transfers that naive indexers credit.