How tipping and marketing miniapps could be exploited by attackers for financial gain.

How tipping and marketing miniapps could be exploited by attackers for financial gain.

https://blog.vrypan.net/2025/05/28/social-attacks-with-monetary-value/

Dad, geek, conversation liquidity provider. vrypan.net (home), @l--o--l (fun). devcoin:$lemon3

🤣 I have to fix this. On the plus side, "Copy link" will give you what you want.

A doodler and computerer. I like permissive/permissionless open source, smart contracts, p2p systems, room-scale VR, and NixOS.

shazow.net

Currently: WhatsABI

Wait. Did it ask you to add your wallet? That's not supposed to happen. It would ask you to add the miniapp, but not the wallet...

if you see x8 visits from me, please know that it's not because the miniapp is wildly successul but that's because that's how many attempts it took me to try and open the post outside of the stupid miniapp container which kept asking me to add to my warplet every time

I don't think it has happened. 

I'm also concerned about signers. That's why I created fcp.

The app keys attack is why I never want to add a new key from a mini app. Iirc this exact style of attack happened with tipping from an app before? Where the dev basically consumed the allowance for you via casting tips that you weren't going to use anyway or something. Maybe someone else remembers better than me