# [MK8DX] Improper verification of Competition creation allows to create "Official" competitions

MK8DX server didn't validate competition attributes, letting any user flag their tournament as Official/Recommended and display it to all players.

- Payout: hidden
- Severity: high
- Program: Nintendo
- Found by: crazy_man123
- Disclosed: 2022-12-15
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1653676
- Library page: https://bugbountylibrary.com/r/h1%3A1653676
- Tags: area:web3 domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:rest technique:reverse-engineering vuln:access-control vuln:misconfiguration

**Target:** NEX MatchmakeExtensionProtocol CreateCompetition server call
**Root cause:** The game server accepted a client-supplied SimpleSearchObject attribute list without validating the Official/Recommended flags, so arbitrary users could mark their competition as official.
**Steps:**
1. Call `MatchmakeExtensionProtocol::CreateCompetition` with a SimpleSearchObject
2. Set attribute index 12 (Official) to `2` and index 13 (Recommended) to `2`
3. Server accepts unvalidated attributes; competition appears in the Recommended section alongside Nintendo official ones
4. Up to 16 slots available since only 4 official competitions existed
**How found:** Researcher inspected the NEX CreateCompetition call and the SimpleSearchObject attributes field, identified indices 12/13 as Official/Recommended flags, and tested whether the server validated them.
**Exploitation:** Attacker creates a competition with Official/Recommended attributes set, causing it to be listed in-game to all players browsing tournaments, enabling message display to the playerbase.
**Escalation:** Could fill up to 16 of the 20 official slots to broadcast messages to all players.
**Insight:** When a client sends a structured attribute array to a server, map each index's meaning from client code and test whether privileged flag values (official/recommended/verified) are server-validated rather than trusted.