# Premium Email Address Check Bypass - Hey

Hey signup validated premium short addresses before stripping spaces, letting 'jp  @hey.com' register a 2-char premium address at the $99 non-premium price.

- Payout: hidden
- Severity: medium
- Program: Basecamp
- Found by: ok_bye_now
- Disclosed: 2020-12-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/963774
- Library page: https://bugbountylibrary.com/r/h1%3A963774
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:parser-differential vuln:business-logic

**Target:** Email signup / premium address validation
**Root cause:** Premium-address length check runs on the raw input including spaces, but spaces are stripped later before the address is finalized, so the validated string differs from the stored address.
**Steps:**
1. Attempt to register `jp@hey.com`; observe Premium alert requiring $999/year.
2. Submit `jp  @hey.com` (two spaces before @) instead.
3. Signup proceeds without premium prompt at $99/year.
4. Spaces are stripped at a later step, yielding the 2-char premium address `jp@hey.com`.
**How found:** Tried to obtain a desired short address, hit the premium paywall, then hypothesized that whitespace padding would alter the length check while being stripped downstream.
**Exploitation:** Attacker submits a premium short address padded with spaces to pass the non-premium length check, then completes signup at the $99 price, locking in the premium address.
**Insight:** When a price tier depends on a string property (length, format), test whether the value is normalized after validation rather than before; padding characters that get stripped later can flip the tier.