Checkout
- Ceramic pour-over dripper112.00
- Paper filters, 100 pack14.50
Total 16.50 USDT
What happens
This page runs on . That is the origin the browser writes into the signature as topOrigin, and the origin the frame reads from location.ancestorOrigins, whatever this page claims to be.
The contract pays only the wallet registered for that origin. If it is not registered, the payment reverts with "site not registered" (test_unregistered_site_reverts), and nothing can reach the real shop's wallet from here.
The fake site can draw over the frame and cover the domain it shows. Turn the overlay on, then press Pay: the frame's site line is covered with the real site's name. The signature still carries this page's origin, so the payee does not change. But if the attacker registered their own domain, a buyer fooled by the overlay pays the attacker. Sitebound shows the real site; it does not vouch for it. Detecting overlays from inside the frame is not checked.