# Race Condition allows to redeem multiple times gift cards which leads to free "money" Race condition in Reverb gift card redemption endpoint let a single card be redeemed multiple times, minting store credit beyond its value. - Payout: hidden - Severity: high - Program: Reverb.com - Found by: muon4 - Disclosed: 2020-01-25 - Write-up quality: 6/10 - Original: https://hackerone.com/reports/759247 - Library page: https://bugbountylibrary.com/r/h1%3A759247 - Tags: area:web domain:web impact:funds-loss impact:integrity kind:bounty platform:hackerone sev:high technique:race-window vuln:accounting-error vuln:business-logic vuln:race-condition **Target:** Gift card redemption endpoint POST //redeem **Root cause:** Redemption of a gift card token is not atomic; concurrent requests all pass the balance/used check before the card is marked redeemed, so the same token credits the account multiple times. **Steps:** 1. Login and buy a gift card. 2. Redeem it at `https://sandbox.reverb.com//redeem` and intercept the POST request containing `token=` and `authenticity_token`. 3. Send the request to Turbo Intruder with a payload that queues ~30 copies gated on `race1`. 4. Set external header `x-request: %s` and launch the attack. 5. Observe multiple 200 OK responses and inflated Reverb bucks balance (e.g. $25 card redeemed 7 times = $175). **How found:** Researcher recognized that gift card redemption is a state-changing balance operation and hypothesized a TOCTOU race, then tested with parallel requests via Turbo Intruder. **Exploitation:** Attacker buys one gift card, then fires many concurrent redemption requests for the same token in a single race window; each successful response credits the account, yielding store credit worth several times the card's value usable for purchases. **Insight:** Any endpoint that credits balance from a one-time token (gift cards, coupons, vouchers) is a race candidate; gate many identical requests to land them in the same check-then-write window and watch for multiple 200s.