---
name: web-business-logic
description: "Guides a reviewer or AI agent through finding business-logic and race-condition weaknesses in payments, limits, coupons, and state machines on an authorized target."
---

# Web business logic and race conditions

Payments, limits, coupons, workflows and state machines that can be bent; race conditions; denial of service through logic.

_From Bug Bounty Library (https://bugbountylibrary.com): generated from disclosed, accepted reports and updated as new ones land. Updated 2026-10-23. Tested on 42 newer reports it was not written from: following it finds about 30% of them._

## Approaching web business logic and race conditions

Business logic flaws live in *intended* behavior, not malformed input. Your job is to model what the app is supposed to do, then find where the implementation diverges from that model under concurrency, repetition, or reordering.

**Map first:**
- Every state machine (order, payment, subscription, coupon, invite) and its legal transitions.
- Every value that flows from client to server: amounts, quantities, IDs, statuses, redirect URLs, declared sizes.
- Every endpoint that mutates state, especially setup/cleanup/alternate submission routes.
- Where money, entitlements, or one-time grants are decided.

**Questions that surface weaknesses:**
- Can I send the same request twice in parallel and get two effects? (check-then-act)
- Does the server trust a client-supplied amount, status, or order_id for payment success?
- Is the value I see validated the same value later stored or billed?
- Does a mutation check *existence* but not *ownership/entitlement*?
- Can a one-time offer be redeemed more than once, or replayed after state change?
- Do setup/cleanup/alternate routes skip auth, 2FA, or policy checks the main path enforces?
- Can I drive allocation or CPU with a declared size, range, or repetition count?
- Are generated links built from client-supplied email/phone/redirect without ownership proof?
- Does any regex on my input backtrack catastrophically?

**Using the patterns:** Treat each pattern as a hypothesis to test against your map. For races, fire parallel requests and compare final state to expected single-effect. For value divergence, trace the same field through validation, storage, and billing. For entitlement, swap object IDs across accounts. For DoS, probe declared-size and regex inputs with bounded, authorized load only. Confirm impact before reporting; note the exact transition or check that failed.

## Patterns

Each pattern below has a full write-up (how it works, where it shows up, how to review for it, variants, impact), grounded in
real disclosed reports. Load the one you need from its link.

### Unbounded allocation from declared input
Caller-declared sizes, counts, depths or codecs driving allocation or CPU with no server-side cap

_20 reports · 5 confirmed bounties, median $500, up to $4,000._
Full pattern: https://bugbountylibrary.com/skills/web-business-logic/unbounded-resource-allocation.md

### Non-atomic check-then-act races
Separate read and write on balances, limits, tokens or single-use state; test with parallel requests

_8 reports · 2 confirmed bounties: $5,000 and $15,250._
Full pattern: https://bugbountylibrary.com/skills/web-business-logic/non-atomic-check-then-act.md

### Catastrophic regex backtracking DoS
Ambiguous or interpolated regexes on user input whose match time grows super-linearly

_8 reports · 4 confirmed bounties, median $1,650, up to $7,640._
Full pattern: https://bugbountylibrary.com/skills/web-business-logic/regex-catastrophic-backtracking.md

### State-changing routes missing sibling-path checks
Setup, alternate-submit, or GET-mutation routes that skip auth, CSRF, 2FA, or policy enforced elsewhere

_8 reports · 3 confirmed bounties, median $3,370, up to $10,000._
Full pattern: https://bugbountylibrary.com/skills/web-business-logic/unauthenticated-state-changing-route.md

### Client-trusted payment success and status mapping
Server crediting goods, wallet, or points from client amount, status string, return URL, or premature order status

_6 reports · 2 confirmed bounties: $531 and $2,000._
Full pattern: https://bugbountylibrary.com/skills/web-business-logic/client-trusted-payment-state.md

### Missing entitlement check on mutations
Mutations that confirm an object exists but never check the caller bought, owns, or is authorized for it

_5 reports · 2 confirmed bounties: $2,000 and $2,000._
Full pattern: https://bugbountylibrary.com/skills/web-business-logic/entitlement-check-missing.md

### Unverified identity in generated links
Links, calls or tokens built from client-supplied email, phone or URL without proving ownership

_5 reports · 3 confirmed bounties, median $900, up to $2,000._
Full pattern: https://bugbountylibrary.com/skills/web-business-logic/unverified-identity-in-generated-links.md

### Displayed vs stored value divergence
Value validated or rendered differs from the value later stored, billed, or granted

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/web-business-logic/display-vs-stored-value-mismatch.md

### Replayable one-time offer redemption
Accept/claim/redeem endpoints for one-time offers that never record consumption or check current state

_3 reports · 2 confirmed bounties: $2,500 and $5,000._
Full pattern: https://bugbountylibrary.com/skills/web-business-logic/replayable-redemption.md

### URL normalization blocklist bypass
Blocklist or allowlist matches raw URL string before normalization; trailing dots or dot-segments evade it

_3 reports · one confirmed bounty: $1,000._
Full pattern: https://bugbountylibrary.com/skills/web-business-logic/url-normalization-blocklist-bypass.md

### Client-supplied order id not bound to package
Payment and order APIs trusting client-supplied order ids, quantities or totals instead of rebinding them server-side to the purchased item

_3 reports · one confirmed bounty: $500._
Full pattern: https://bugbountylibrary.com/skills/web-business-logic/client-supplied-order-binding.md

### Unhandled rejection across sandbox bridge
Promises crossing a sandbox or plugin boundary without a rejection handler, crashing the host process

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/web-business-logic/sandbox-bridge-unhandled-rejection.md

## Rarer patterns

Seen only once or twice so far, so there is no full write-up yet; each links to the report that shows it.

- **Identity spoofing via mutable display fields**: User-settable names, owners, or origins rendered as trusted identity; check legacy APIs and bidi styling (https://bugbountylibrary.com/r/blog%3Aehpus-com-post-author-spoofing-in-google-colaboratory.md)
- **Parameter pollution overrides checks**: Duplicate or injected params override secrets, redirect targets, or verification values (https://bugbountylibrary.com/r/blog%3Aandresriancho-com-recaptcha-bypass-via-http-parameter-pollution.md)
- **Unthrottled enumerable lookup with distinct responses**: Short-code or identifier lookup lacks rate limiting and returns distinguishable responses for valid vs invalid (https://bugbountylibrary.com/r/h1%3A125200.md)
- **Delimiter-free signature concatenation**: Hash computed over concatenated fields without delimiters, allowing field boundary shifting (https://bugbountylibrary.com/r/h1%3A1295844.md)
- **Demo data counted in real scoring**: Demo, sandbox, or test submissions flow into the same ranking or points pipeline as production data (https://bugbountylibrary.com/r/blog%3Ablog-securitybreached-org-2023-04-19-how-i-manipulated-my-rank-on-the-bugcrowd-platform.md)
- **Optional freshness parameter skips version check**: Approval or update endpoints accept an optional version or timestamp that, when omitted, bypasses staleness checks (https://bugbountylibrary.com/r/h1%3A3610332.md)
- **Rate limit bypass via batching**: Per-request limits evaded by aliased mutations or batched operations in one request (https://bugbountylibrary.com/r/h1%3A2166697.md)
- **Redirect-following attribution abuse**: Server-side ping or fetch follows cross-domain redirects, attributing the action to the redirect target (https://bugbountylibrary.com/r/blog%3Atomanthony-co-uk-blog-google-xml-sitemap-auth-bypass-black-hat-seo-bug-bounty.md)