Detected by: Satoshi Nakamoto (Ghost Protocol) Target: Binance Mobile App – Android / iOS Classification: High Risk Status: Awaiting response from the official team
---
⚠️ CRITICAL ERROR: Session Validation Failure + Misalignment with the Server
Bug Summary: During advanced load testing and connectivity variation (airplane mode + reconnect), we identified that expired session tokens are not being handled correctly, resulting in:
Misalignment between local state (cache) and actual API response
Execution of orders that are not reflected in the immediate history
WebSocket remains active even with an invalid token, generating false positives of order state
Critical failures in the MFA recovery path, where the app reconnects without revalidating the user's identity
---
📉 Associated Risks:
Ghost order execution
Exposure to session replay or WebSocket spoofing attacks
Possibility of creating malicious execution scripts with inconsistent behavior between REST API vs WebSocket
---
✅ Proposed Solution – Ghost Protocol:
1. Hard refresh of session upon detecting divergence between WebSocket and REST.
