



EASY ACCOUNT TAKEOVER USING IDOR (Bug Bounty)
Changing one number in a URL shouldn't give you someone else's account—but it often does. Insecure Direct Object Reference (IDOR) remains one of the most critical yet overlooked web vulnerabilities, frequently leading to full account takeover with minimal effort.

How I Found a Critical Swagger Exposure in a Web Application
During testing, I discovered that the test environment's Swagger UI at https://[test-api-domain]/swagger/index.html is fully accessible to anyone on the internet without any authentication. This endpoint returns a complete OpenAPI/Swagger specification containing all API endpoints, request/response schemas, data models, and internal architecture details.


Permanent Lock of All User Funds Due to Insufficient Price Validation
A single missing validation check in the setTokenPrice(), function can permanently brick an entire TokenSwap contract. Once exploited, every single user fund becomes trapped forever. No recovery. No fix.


