API6:2023 — Unrestricted Access to Sensitive Business Flows

Slide 9 · Two Attack Patterns

Monopolize the inventory. Farm the rewards.

Two dominant patterns — same missing business controls.

Pattern 1: Inventory Monopolization

Acquire all of a scarce resource before real users can

Bot opens hundreds of parallel sessions

Each session completes the purchase or reservation flow

No per-account purchase limit enforced at the API

Inventory depletes; real users see “sold out”

Acquired inventory resold at a markup

Pattern 2: Reward / Referral Farming

Extract monetary value from incentive programs at scale

Bot creates thousands of accounts automatically

Each account uses a referral code from another bot account

Each registration triggers a referral reward payout

No verification distinguishes real users from bot accounts

Business pays out real money; no real customers acquired

What makes both possible

Both patterns exploit the same gap: the API implements the flow correctly but has no business-level controls — no purchase cap, no minimum completion time, no account verification gate, no anomaly detection for machine-speed activity. The API does exactly what it’s supposed to do; the business rules never said “not this fast, not this many times.”

← Back Pattern 1: Inventory monopolization →