$#business-logic

Hacker Holidays — Day 8: Towel on the Sunbed

A crypto rewards app rate-limits its daily claim to once per 24h, but the check-then-act isn't atomic — firing 30 parallel requests with Burp's last-byte sync lets every one of them win the race.

• #hacker-holidays
• #race-condition
• #business-logic