Figma · Report #996141
Race condition while removing the love react in community files.
Summary
The researcher found that the server-side code for handling the "unlike" function for community pages was vulnerable to a race condition. While logically one person is only allowed to remove the one like they had, a hundred requests at the same time could allow one person to do a hundred unlikes. We were already aware of this bug and it was already fixed in our repository. The fix was pushed to production the day after triaging. Since we want to encourage high quality reports, we still paid out for a bug that we already knew about and had fixed.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.