13 days ago
We’ve been looking into how SimpleSwap handles their loyalty incentives and found an interesting gap. Basically, the endpoint that applies the one time Loyalty Bonus which is supposed to be reserved for high-volume users doesn't have proper server-side validation. Because of that, it can actually be triggered externally by modifying a client-side request, bypassing the usual session checks.
