# Inside the benchmark: app architectures, walkthroughs of findings, and what each scanner actually caught

VaultBank dispute review endpoint credited refund_amount to the account without checking it against the original transaction, letting a user dispute $10 and refund $999,999.99.

- Payout: Research
- Severity: critical
- Program: VaultBank
- Write-up by: Neo
- Disclosed: 2026-03-11
- Write-up quality: 6/10
- Original: https://projectdiscovery.io/blog/inside-the-benchmark-pp-architectures-finding-walkthroughs-and-what-each-scanner-actually-caught
- Library page: https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-inside-the-benchmark-pp-architectures-finding-walkthroughs-and-what-each-scanner-actually-caugh
- Tags: area:web domain:api impact:funds-loss kind:research platform:research sev:critical tech:python technique:source-review vuln:business-logic

**Target:** FastAPI dispute review endpoint (backend/app/routers/disputes.py)
**Root cause:** The dispute resolution handler adds refund_amount to the account balance without validating that the refund does not exceed the original transaction amount.
**Steps:**
1. Read backend/app/routers/disputes.py and trace dispute resolution logic
2. Identify lines 220-227: `from_account.balance += refund` with no check that refund <= transaction.amount
3. Send `POST /disputes/1/review` with `refund_amount: 999999.99` against the live deployment
4. Observe HTTP 200 and balance increased by $999,999.99
**How found:** A repository-focused agent read the disputes router and traced the resolution logic, spotting the balance credit with no comparison to the original transaction amount; Neo then built a targeted request to confirm the missing business rule at runtime.
**Exploitation:** An authenticated customer files or targets a dispute on a small transaction, then submits a review request with an arbitrarily large refund_amount; the endpoint credits the full amount to the account balance.
**Insight:** In dispute/refund flows, check whether the credit amount is validated against the original transaction record, not just whether the caller is authorized to review the dispute.

## Proof of concept (copied exactly from the original report)

**Dispute refund PoC request with oversized refund_amount**

```
Neo crafted a targeted request POST /disputes/1/review with refund_amount: 999999.99 so that it could test whether the endpoint enforced any relationship between the refund and the original transaction amount
- Neo successfully executed against the live deployment: HTTP 200, balance increased by $999,999.99
```

**Mass assignment probe PUT /me with role admin**

```
Neo sent one request PUT /me with {"role": "admin", "first_name": "test"}, and observed that first_name updated but role remained customer
```