How to Find Business Logic Vulnerabilities in Bug Bounty
Business logic bugs are flaws in the rules of the product — not missing sanitization. Scanners rarely find them. Hunters who read the workflow carefully still do.
If IDOR is “access the wrong object,” logic bugs are “make the process do something the business never intended.”
Start with the money and trust flows
Sketch:
- Registration → trial → paid plan
- Cart → coupon → tax → payment → fulfillment
- Invite → accept → role grant
- Refund → partial refund → chargeback notes
- Credits, referrals, gift cards, and quotas
Mark which steps are client-visible and which must be enforced server-side. Anything priced, limited, or approval-gated is a candidate.
Techniques that work
Skip a step: complete checkout without payment confirmation; accept an invite twice; mark shipped without payment.
Replay: reuse an order token, coupon, or invite after it should be consumed.
Parameter math: negative quantities, fractional quantities, currency mismatch, or price fields sent from the client.
Race conditions: parallel redeem or transfer requests on a single-use benefit (related to race bugs, but framed around business invariants).
Workflow confusion: start as user A, finish as user B; attach payment method from one account to another order.
Always use test modes, fake cards the program allows, and low-value items.
Evidence programs trust
Show the intended business rule in one sentence, the request sequence that breaks it, and the resulting unfair advantage (free SKU, elevated role, unlimited quota). Include before/after balances on accounts you own.
Avoid these traps
- Reporting “I can click buy without filling the address UI” when the server still requires it
- Pure UI bypasses with no server impact
- Destructive tests against production inventory
Report template
- Business rule
- Actors (two test accounts)
- Step-by-step requests
- Impact in business terms
- Suggested server-side invariant
Defensive checklist
- Encode invariants in the service layer and database constraints.
- Make tokens single-use and bind them to user + cart + amount.
- Recompute price and eligibility on the server.
- Use idempotency keys for payment and redeem APIs.
- Add tests for negative quantities, replay, and step skipping.
Logic flaws match how people search: “business logic vulnerability bug bounty.” They reward product understanding more than payload lists — which is exactly why they stay valuable.
Original Bugflare guide informed by PortSwigger business logic vulnerability material.