How i was able to get free money via sending negative tokens

How i was able to get free money via sending negative tokens

Hello Awesome Hackers, I hope you all doing well!
My name is Mohamed Anani Or 0xM5awy.

In this Write-Up, we will talk about how I got free money by sending negative tokens

In the beginning, let’s explain how the website works. The site has two permission, the first is a user and the other is streamer. The site provides users to buy tokens in order to support streamers and streamers can also send tokens to anouther streamer, and this turns into money for streamers, so I tried to find a way to own tokens without buying them, and through this I will create a streamer account and send tokens for myself To infinity

I started to understand all the functions on the website until I found a function that allows the user to send private messages to streamroll. To do this, you must buy private messages for tokens. Unfortunately, I did not find any bug here. But what comes after this is the important thing :)

After I bought private messages in order to be able to message the streamer, it turned out that there are 3 functions inside the private chat

  • Send a private message to the streamer ( I didn’t find anything )

Now my eyes are shining and the first thing I think of is what will happen if I send negative tips? Like ( -5 , -10 , etc. ) so I did and the request was like.

POST /endpoint HTTP/1.1
Host: 0xM5awy.com
{"message":"negative tips","tokens":-100"}

ANDDDDDDDDDDDDDD BOOOOOOOOOOOOOOOOOOOOOOOOOM WE DID IT

100 negative token have been sent to streamer and I was have 150 token before now i have 250 :DDDDDD

Attack Workflow:

  • The attacker will have two accounts, one is streamer and the other is user

Impact

The attacker can get free coins infinitely, and these coins will turn into money. Imagine how much money he will earn :)

--

--

There is no safe system forever :")

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store