Infinite money logic flaw

Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

A reusable discount makes a gift card cost less than the credit received when it is redeemed. Repeating the purchase-and-redeem cycle increases the account balance.

Lab objective/setup

This intentionally vulnerable Academy exercise isolates infinite money logic flaw. The supplied accounts and endpoints are used to reproduce only the source note evidence for infinite money logic flaw; all request changes remain inside this Academy instance.

What I observed

Newsletter registration reveals the reusable SIGNUP30 voucher. In the lab, it reduces a $10 gift card to $7, while redeeming the purchased code adds the full $10 to the account. The recorded balance change from $100 to $103 proves a positive-value cycle, and the coupon remains valid on the next purchase.

Why it is vulnerable

Individually valid promotions and stored-value operations create an arbitrage loop because the application does not enforce one-time use or prevent positive-value cycles.

Walkthrough in the authorized PortSwigger lab

1. Subscribe to the newsletter to obtain SIGNUP30, add the $10 gift card to the cart, apply the voucher, and complete checkout for $7.
2. Redeem the returned gift-card code and verify that the balance rises by $10, producing a net $3 gain. Reapply SIGNUP30 to confirm it is not invalidated after use.
3. Create a Burp session macro covering the recorded sequence: add the gift card, apply the coupon, check out, request /cart/order-confirmation, extract the newly issued gift-card code from that response, and submit it to /gift-card for redemption.
4. Attach the macro to an Intruder-driven session rule so each iteration runs the complete purchase-and-redeem workflow. The source note records roughly 400 iterations to approach the $1,337 jacket price.
5. Once the lab balance is sufficient, purchase the Lightweight l33t leather jacket and confirm the Academy completion state.

Verification

The final capture shows the Academy marking the infinite money logic flaw exercise as solved after the documented request sequence. No testing was performed outside the isolated lab.

Impact and defensive lesson

The defect is an arbitrage loop composed of individually valid operations: a reusable discount lowers acquisition cost below redemption value. Voucher redemption must be scoped and invalidated as intended, stored-value issuance and redemption should be checked as one economic workflow, and monitoring should detect repeated same-account purchase/redemption cycles even when every database transaction is syntactically valid.

References

• PortSwigger lab
• PortSwigger Web Security Academy
• OWASP Web Security Testing Guide