Submission Date: July 6, 2026
Tester: Samuel Oluwayomi
Contact: @DevSamie on Telegram
Email: [email protected] Repository: https://github.com/SamuelOluwayomi/multihopper-bounty
This report documents 10 findings discovered during systematic security and integration testing of the MultiHopper API agentic flow (create → prepare → sign/broadcast → confirm-broadcast → monitor).
All security findings were first identified on devnet (https://devnet.multihopper.com) and subsequently confirmed on mainnet (https://multihopper.com). Mainnet transfer IDs 104–117 were created as quote-only — never signed or broadcast. isTest: false on those responses confirms production environment access. All testing remained within the documented API surface and respected rate limiting. No funds were moved, no transactions were broadcast, and no destructive actions were taken on mainnet.
The two strongest findings both originate from the same root cause: the overrides parameter in POST /transfers is merged into the request body without server-side allowlisting. This creates two distinct security issues:
The findings are organized by category to facilitate triage by the review team.
We built a four-phase automated testing harness to evaluate protocol invariants:
| Phase | Tool | What It Does |
|---|---|---|
| Agentic Harness | src/harness.py |
Validates the full create → prepare → confirm flow, error codes, status polling, input boundaries |
| Deep Probes | src/deep_probes.py |
Tests concurrency, blockhash expiry, state-machine transitions, idempotency edge cases |
| PoC Prober | src/poc_probe.py |
Standalone reproducers for the highest-impact findings with raw evidence capture |
| AI Oracle | src/ai_red_team.py |
Autonomous adversarial testing using Gemini and Llama 3.3 to explore non-obvious attack paths |
Environment:
requests, solders, base58, python-dotenvHDpuuLudmQeCjm52z1L8SC8eMAX85QEdum6KPu2b6TgW9ad4kxFx9ZLbLsZk8UwpbtdLcdz38dwTGpQuPw3BPyF2| ID | Severity | Title | Root Cause | Confirmed On | Evidence |
|---|---|---|---|---|---|
| 01 | High | overrides merging allows arbitrary overwrite of core financial fields |
Unsafe body merge | Devnet + Mainnet | Mainnet Transfer ID 114, Devnet Transfer ID 294 |
| 02 | High | SQL/ORM information disclosure in HTTP 500 response via overrides injection |
Unsafe body merge | Devnet (intermittent) | AI Oracle Turn 9, poc_evidence.md (POC-001) |
| ID | Severity | Title | Root Cause | Confirmed On | Evidence |
|---|---|---|---|---|---|
| 03 | Medium | Duplicate externalId not rejected with documented error MH_033 |
Validation logic gap | Devnet (mainnet rate-limited) | Devnet Transfer ID 296, harness.py output |
| 04 | Low | HTTP 404 returned for malformed signature payloads (agentic confusion) | Status code mapping | Devnet + Mainnet | Mainnet Transfer ID 115, Devnet Transfer ID 295 |
| 05 | Low | hops range boundary violations not rejected with documented code MH_013 |
Validation bypass | Devnet | harness.py output |