# Race condition leads to Inflation of coins when bought via Google Play Store at endpoint https://oauth.reddit.com/api/v2/gold/android/verify_purchase

Race condition in Reddit's Android coin purchase verification endpoint let an attacker replay one Google Play transaction_id in parallel to receive coins multiple times.

- Payout: hidden
- Severity: medium
- Program: Reddit
- Found by: yashrs
- Disclosed: 2021-10-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/801743
- Library page: https://bugbountylibrary.com/r/h1%3A801743
- Tags: area:mobile domain:api domain:mobile impact:funds-loss impact:integrity kind:bounty platform:hackerone sev:medium tech:android technique:race-window vuln:accounting-error vuln:business-logic vuln:race-condition

**Target:** oauth.reddit.com /api/v2/gold/android/verify_purchase
**Root cause:** The verify_purchase endpoint checks whether a transaction_id was already redeemed and credits coins without an atomic lock, so concurrent requests with the same transaction_id all pass the check before any redemption is recorded.
**Steps:**
1. Purchase a 50-coin package in the Reddit Android app and intercept the POST to `/api/v2/gold/android/verify_purchase` with `transaction_id`, `token`, `package_name`, `product_id`, `correlation_id`.
2. Send the identical request in parallel (e.g. 10 concurrent) reusing the same `transaction_id=GPA.3390-9967-2355-57063`.
3. Observe ~9 of 10 requests succeed and each credits coins, yielding ~9x the purchased amount.
**How found:** Researcher inspected the mobile purchase flow, noticed the endpoint takes a transaction_id and token, and hypothesized that redemption state was checked non-atomically, then tested by firing the same request in parallel.
**Exploitation:** Attacker buys one cheap coin package, captures the verify_purchase request, and replays it concurrently many times; each successful response credits the coin balance, multiplying coins for a single real payment.
**Escalation:** Scaling the number of parallel requests (e.g. 40) increases the multiplier of coins obtained per single purchase.
**Insight:** On mobile IAP verification endpoints, replay the same transaction_id/receipt concurrently rather than sequentially; the sequential replay is usually blocked but the check-then-credit window often isn't atomic.