Logic Issue with Reputation: Boost Reputation Points

How it was found

Hi,

I'm disclosing a bug that can allow a program member to escalate a profile reputation by +2 points indefinitely till the extent he/she wants and the process will be somewhat stealthy as there won't be a trace on member's profile (say fake resolved bugs etc).

Prologue

BugBug - Imaginary program at HackerOne User A - Member of BugBug at HackerOne User B - A test account User C - Another test account

Issue and Repro

1. Create a ticket with user B at BugBug
2. Create a ticket with user C at BugBug
3. Mark user C's ticket as resolved
4. Mark user B's ticket as Duplicate of user C's ticket
5. Now reopen user C's ticket and mark it as resolved.
6. Repeat the last step, that is step 5 for 50 times and you'll see user B's reputation will boost up by 100 points. And of course there won't be any trace on user B's profile publicly as the ticket is marked duplicate.

P.S: All program associated steps are done by user A like marking ticket as resolved/dupe

To avoid confusion here's a short video as well - Dropbox

Thanks, Prakhar Prasad