#business-logic-vulnerability

TryHackMe : Towel on the Sunbed Writeup

TL;DR Ponzi Portfolio is a Node.js/Express "staking rewards" web app with a 24-hour cooldown on claiming a reward. The /claim endpoint has a classic check-then-act race condition: it checks whether th