Hunt Fintech Graphql
Hunt fintech-specific GraphQL vulnerabilities: money-movement mutations (transfers...
Install
npx skills add elementalsouls/Claude-BugHunter --skill hunt-fintech-graphql -g -a claude-code -y- Repository
- elementalsouls/Claude-BugHunter5.4k
- Category
- Security
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunt fintech-specific GraphQL vulnerabilities: money-movement mutations (transfers, redemptions, withdrawals, card top-ups), ledger/balance/portfolio query IDOR, decimal-precision and rounding abuse, idempotency-key bypass enabling double-spend, KYC/PII field-level authorization gaps, and admin-override mutations reachable via mass assignment. Distinct from hunt-graphql, which owns generic GraphQL discovery and IDOR/mutation methodology, this skill owns the delta introduced when a GraphQL layer sits in front of a ledger, wallet, payments, banking, brokerage, or lending backend, where a resolver bug moves real money instead of just leaking data. Use when hunting a fintech, banking, payments, wallet, neobank, brokerage, or lending target that exposes a GraphQL API, or when a schema/response includes balance, transfer, ledger, redeem, quote, KYC, or account-linking fields.
Why Fintech GraphQL Is a Different Risk Class
Generic GraphQL bugs (IDOR, mass assignment, introspection, batching abuse, see hunt-graphql)
still apply here, but the blast radius changes completely: a resolver bug in a SaaS app leaks
data, the same class of bug in a ledger mutation moves money. Three properties make fintech
GraphQL backends a distinct hunting surface:
- Money-movement mutations are almost always resolvers over a double-entry ledger. A single
GraphQL mutation (
transferFunds,redeemRewards,withdrawToBank) can trigger multiple ledger writes (debit + credit + fee) that must be atomic. GraphQL's flexible input shape and alias batching make it easy to desynchronize those writes. - Decimals are attacker-controlled input, not display formatting. Amounts, exchange rates,
interest, and rewards points are usually passed as GraphQL scalars (
Float,String, customDecimal/Moneyscalar). How the resolver parses and rounds that value is exploitable surface in its own right, this barely exists in non-financial GraphQL APIs. - KYC/PII fields sit next to routine account fields in the same type.
UserorAccounttypes commonly exposessnLast4,routingNumber,kycStatus,governmentIdUrl, orlinkedBankAccountalongsidedisplayNameandemail, one missing field-level authorization check on a type used everywhere in the schema fans out to every query that touches it.
Attack Surface Signals
URL / schema naming patterns (in addition to hunt-graphql's generic /graphql list):
/graphql/ledger
/graphql/payments
/api/wallet/graphql
/internal/ledger-graphql
/banking/graphql
