> they merely need to find a merchant which uses Stripe for bitcoin payments [...]
> or even better, set up to automatically refund bitcoin overpayments
Any idea what proportion of merchants using Stripe's bitcoin handling actually do this automatic refunding?
It's a very interesting vulnerability and I enjoyed reading the write-up and thought process, but I'm not sure how practical it is if it requires interaction from the merchant to perform the refund. I think an overpayment and refund request weeks after the initial payment (when coincidentally the BTC value has reduced) would definitely ring some alarm bells - hopefully with both the merchant and the team at Stripe.
I guess you could spread out your overpayments amongst different merchants and try and limit the time between the initial purchase and the refund requests but the entire thing seems a bit convoluted to pull off.
In any case, kudos to the author for the responsible disclosure and for Stripe for handling this professionally.
Any idea what proportion of merchants using Stripe's bitcoin handling actually do this automatic refunding?
It's a very interesting vulnerability and I enjoyed reading the write-up and thought process, but I'm not sure how practical it is if it requires interaction from the merchant to perform the refund. I think an overpayment and refund request weeks after the initial payment (when coincidentally the BTC value has reduced) would definitely ring some alarm bells - hopefully with both the merchant and the team at Stripe.
I guess you could spread out your overpayments amongst different merchants and try and limit the time between the initial purchase and the refund requests but the entire thing seems a bit convoluted to pull off.
In any case, kudos to the author for the responsible disclosure and for Stripe for handling this professionally.