# OLO Total price manipulation using negative quantities

Upserve order API accepted a negative-quantity line item, letting an attacker reduce the order total and pay less than the real price.

- Payout: hidden
- Severity: critical
- Program: Upserve 
- Found by: fuzz
- Disclosed: 2019-07-06
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/364843
- Library page: https://bugbountylibrary.com/r/h1%3A364843
- Tags: area:web domain:api impact:funds-loss kind:bounty platform:hackerone sev:critical tech:rest vuln:accounting-error vuln:business-logic

**Target:** Order submission API endpoint (orders.upserve.com)
**Root cause:** Server trusted client-supplied item quantities and totals when computing the order price, without validating that quantities are non-negative or recomputing totals server-side.
**Steps:**
1. Submit an order JSON to orders.upserve.com with two ChickenBurger items (price 1200, quantity 2) and one BreadPudding item with `"quantity": -1` (price 900).
2. Set the charges total to `1870` and order_total to `3190` in the request.
3. Observe the system accepts the negative quantity and computes a reduced total ($18.70) which is charged.
**How found:** Researcher manipulated the order request JSON, adding an item with a negative quantity and observing the total price change.
**Exploitation:** Attacker crafts the order request with a negative-quantity item so the computed total drops; the reduced amount is accepted and charged, yielding goods below cost.
**Insight:** When testing e-commerce/order APIs, try negative or fractional quantities and mismatched client-supplied totals to see if the server recomputes price or trusts the payload.