# Add more seats by paying less via PUT /v2/seats request manipulation

Krisp seat-adding API rounds fractional seat counts up for allocation but floors them for billing, letting users get extra seats at lower cost.

- Payout: hidden
- Severity: medium
- Program: Krisp
- Found by: life__001
- Disclosed: 2022-06-20
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1446090
- Library page: https://bugbountylibrary.com/r/h1%3A1446090
- Tags: area:web3 domain:web impact:funds-loss kind:bounty platform:hackerone sev:medium technique:param-pollution vuln:accounting-error vuln:business-logic

**Target:** PUT /v2/seats billing endpoint on account.krisp.ai
**Root cause:** Seat count is used with Math.ceil for allocation but Math.floor for price calculation, so a fractional value like 1.9 grants 2 seats while charging for 1.
**Steps:**
1. Register and install the app, create a team.
2. Go to billing with Burp intercepting.
3. Capture the add-seat request.
4. Replace seat count with `1.9`.
5. Observe 2 seats added but price increased by only $60 (one seat).
**How found:** Researcher noticed the seat quantity field accepted non-integer values and reasoned about how ceil vs floor would diverge between allocation and pricing.
**Exploitation:** Attacker submits fractional seat quantities in the add-seat request; allocation rounds up while billing rounds down, then can add/delete seats to reduce total price.
**Insight:** When a numeric quantity drives both a resource grant and a price, test fractional/negative/overflow values to expose rounding mismatches between the two code paths.