HexBrain

Figma · Report #996141

Race condition while removing the love react in community files.

Validstatus
lowseverity
$150bounty
45upvotes
10 Oct 2020disclosed

Summary

The researcher found that the server-side code for handling the "unlike" function for community pages was vulnerable to a race condition. While logically one person is only allowed to remove the one like they had, a hundred requests at the same time could allow one person to do a hundred unlikes. We were already aware of this bug and it was already fixed in our repository. The fix was pushed to production the day after triaging. Since we want to encourage high quality reports, we still paid out for a bug that we already knew about and had fixed.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original