Infinite Money Glitch? How Our Team Generated Infinite Money on a Fortune 100 Financial Site

The "Infinite Money" Glitch

While testing a large credit-card management application with hundreds of thousands of users, our team discovered a business-logic vulnerability in a Salesforce Aura endpoint that effectively allowed us to generate money.

The application allowed customers to redeem rewards points for a monetary credit applied to their account. The problem was simple: the redemption flow accepted negative reward-point values. Instead of rejecting the invalid value, the application processed it in a way that allowed us to repeatedly generate real monetary credit on the account.

Why Was Something This Serious Still There?

The vulnerable functionality lived behind Salesforce Aura. Aura applications can be difficult to navigate and understand from a security-testing perspective, and many researchers are unfamiliar with how to inspect the framework, identify useful actions, and reason about the underlying application behavior.

That is an area our team specializes in. We spend a significant amount of time testing Salesforce Aura applications, but finding the endpoint was only half of the problem. The vulnerability itself was fundamentally a business-logic issue: the server trusted an assumption about what a valid rewards redemption should look like instead of enforcing that assumption.

Technical Complexity Isn't Always the Risk

There was no elaborate exploit chain required. Once the relevant functionality was understood, the impact came from asking a basic question: what happens if we redeem an amount the application never expected?

In this case, that question exposed a flaw with direct financial impact on an application serving hundreds of thousands of users. It is a good example of why our testing focuses heavily on manual application behavior, authorization, Salesforce Aura, and business logic — not just automated vulnerability scanning.

We're the team behind Broken Access Pentests. We specialize in manual web application and API pentesting, particularly the weird authorization and business-logic flaws that automated scanners (and AI) tend to miss.

If you'd like us to see what we can find in your application, check us out at brokenaccesspentests.com.