domains / families / security / hunt-business-logic

hunt-business-logic

authentic

Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-quantity-in-cart price tampering (Upserve, Eternal/Zomato), decimal/fraction price-field overflow (Shipt), client-side checkout amount trust on PayPal redirect (WordPress.org), price-per-unit mass-assignment (Krisp), and archived-price swap / cart-TOCTOU (Stripe). Use when hunting business logic — heavy emphasis on financial-impact-demonstrated cases.

When to use

• coupon-race-stacking
• negative-quantity-in-cart price tampering
• decimal/fraction price-field overflow
• client-side checkout amount trust
• price-per-unit mass-assignment
• archived-price swap / cart-TOCTOU
• payment flow manipulation
• identity/verification bypass

Skill page

Source