# OK.ru: tampered payment amount mints cheap OK coins

OK.ru payment flow trusted client-supplied LMI_PAYMENT_AMOUNT, so paying 0.01 RUB credited 1 OK coin, 50x cheaper than face value.

- Payout: hidden
- Severity: medium
- Program: ok.ru
- Found by: 4lemon
- Disclosed: 2016-04-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/78436
- Library page: https://bugbountylibrary.com/r/h1%3A78436
- Tags: area:web domain:web impact:funds-loss kind:bounty platform:hackerone sev:medium tech:payment technique:param-pollution vuln:business-logic

**Target:** WebMoney payment initiation endpoint (LMI_PAYMENT_AMOUNT parameter)
**Root cause:** The payment callback/flow verified only that some transaction was paid, not that the paid amount matched the order amount, and credited balance rounded up to 1 OK.
**Steps:**
1. Click "пополнить" (top up), any amount.
2. Select "Вебмани" as payment method.
3. Enable Burp interception, click "Перейти к оплате".
4. Change `LMI_PAYMENT_AMOUNT=0.01` in the request and forward it; disable interception.
5. Follow the redirect cascade to the WebMoney payment gate and pay.
6. Observe "Вы получили 1 OK" — 1 OK credited for 0.01 RUB.
**How found:** Noticed the amount parameter was client-controlled and tested lowering it to one kopeck, then observed the balance still credited 1 OK.
**Exploitation:** Attacker intercepts the top-up request, sets LMI_PAYMENT_AMOUNT to 0.01, completes the tiny WebMoney payment, and receives 1 OK credited; repeatable/automatable and gift certificates to third parties are equally vulnerable to the same parameter swap.
**Escalation:** Automation allows bulk purchase of OK at ~50x discount, then distribution via gift certificates.
**Insight:** On payment integrations, tamper the amount field in the pre-payment request and check whether the server reconciles the callback amount against the order; rounding-up of credited units turns a tiny underpayment into full value.