# New API: Integer overflow in quota billing yields negative charges (self-crediting)

New API quota billing multiplied user-controlled quantity params without bounds, so an extreme image n value wrapped int64 negative at settlement, crediting the attacker's balance.

- Payout: Research
- Severity: critical
- Program: New API
- Found by: lihui12388
- Disclosed: 2026-08-17
- CVE: CVE-2026-71479
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-8r8v-xf7q-rcpr
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-8r8v-xf7q-rcpr
- Tags: area:web3 domain:api domain:web3 impact:funds-loss impact:integrity kind:research platform:ghsa sev:critical technique:source-review vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** API quota/billing settlement path (image generation quantity parameter)
**Root cause:** User-controlled quantity multipliers (e.g. image `n`) entered quota math without upper-bound validation, and float64-to-int conversions lacked saturation, so extreme values wrapped past int64/int32 into large negative quotas. Pre-consume only checks `userQuota > 0` and balance, and does not apply multipliers, so the wrap only manifests at settlement where a negative charge credits the balance.
**Steps:**
1. Hold an account with balance > 0 covering the normal pre-consume amount (or obtain seed balance via check-in/invite/new-user gifts).
2. Send a request with an extreme quantity multiplier, e.g. image `n = 18446744073686646784`, accepted by a `*uint` field as a wrapped negative.
3. Pre-consume passes (multipliers not applied there); at settlement `int(float64(quota) * n)` wraps to a large negative quota.
4. Negative settlement is applied as a credit, inflating the attacker's balance.
**How found:** Community user observed large negative consumption entries in logs and abnormally inflated balances on their deployment, indicating settlement-time arithmetic wrap from user-controlled multipliers.
**Exploitation:** Attacker registers (mass-registration when free-balance features are enabled) to get a small positive balance, then issues a single crafted request with an extreme `n` value; the settlement-time overflow flips the charge negative, crediting an enormous balance. Sustained abuse drains the operator's prepaid upstream funds and can render billing/service unavailable.
**Escalation:** Enabling free starting balance (check-in rewards, invite rebates, new-user quota gifts) with self-registration turns the positive-balance precondition into free, at-scale, effectively unauthenticated exploitation.
**Insight:** When a billing system separates pre-consume authorization from settlement, check whether multipliers are applied only at settlement — an overflow there bypasses the balance gate entirely; also treat `*uint` fields as able to carry wrapped negatives, so `>= 0` checks are insufficient and explicit upper bounds plus saturating conversions are needed.