Race / limit overrun

Tags: race, logic, ato

Typical severity: P2-P4

What it becomes

Coupon once, gift-card drain, extra votes, extra MFA tries, extra password-reset, extra invitations.

Where to look

• checkout

  Copy

• redeem

  Copy

• vote

  Copy

• follow

  Copy

• invite

  Copy

• 2FA verify

  Copy

• password reset

  Copy

Chains

• Financial — Apply the same coupon or withdraw the same balance N times.
• ATO — Race the email-change vs verify, or brute OTP without the rate limit incrementing.

Notes

• Turbo Intruder last-byte sync or the single-packet attack is the current default technique.
• Demonstrate economic impact with a small N. Do not drain a production gift-card pool.