skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-fintech-graphql

Tests fintech GraphQL APIs for money-movement, ledger, and authorization vulnerabilities.

Updated Sep 6, 2026
Search Tags:#penetration testing#graphql#fintech#api security#bug bounty#idor#double-spend
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-fintech-graphql-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-fintech-graphql
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-fintech-graphql
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-fintech-graphql-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Fintech GraphQL APIs sit in front of ledgers, wallets, and payment systems where a single resolver bug can move real money, yet generic GraphQL testing guidance misses the financial-specific attack surface like decimal rounding abuse, idempotency replay, and source-account authorization gaps. ## Core Features & Use Cases - Money-Movement Mutation Testing: Systematically maps and probes transfer, withdrawal, redemption, and top-up mutations for idempotency-key replay, double-spend via alias batching, and non-atomic ledger writes. - Decimal & Precision Abuse Probes: Tests custom Money/Decimal scalars with sub-cent amounts, scientific notation, oversized values, and negative amounts to expose rounding drift and float-parsing fallbacks. - Fintech-Specific Authorization Checks: Detects asymmetric source-account IDOR, nested KYC/PII field-level authorization gaps, and admin-tier mass assignment on transaction input objects. - Use Case: When assessing a neobank or brokerage target exposing a GraphQL endpoint, use this methodology after generic schema discovery to test whether transferFunds validates source-account ownership and whether replayed idempotency keys produce duplicate ledger writes. ## Quick Start Ask the AI to hunt fintech-specific GraphQL vulnerabilities on an authorized bug bounty target that exposes balance, transfer, or ledger mutations.

Frequently Asked Questions about hunt-fintech-graphql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test GraphQL transfer mutations for double-spend vulnerabilities?▼

Send the same mutation with an identical idempotencyKey twice and check whether two distinct transactionIds result. Then use alias batching to repeat a redeem or transfer mutation multiple times in one request, escalating to parallel HTTP requests if the resolver does not serialize writes per account.

What GraphQL vulnerabilities are specific to fintech APIs?▼

Fintech-specific issues include decimal-precision and rounding abuse on Money scalars, idempotency-key bypass enabling replayed ledger writes, source-account authorization gaps in transfer mutations, and KYC/PII field exposure through nested types like transaction counterparty objects.

How is fintech GraphQL testing different from generic GraphQL testing?▼

Generic GraphQL testing covers introspection, IDOR, and batching, while fintech testing targets the ledger layer behind resolvers. A resolver bug here moves money rather than just leaking data, so it adds amount parsing, currency consistency, and atomicity checks.

Does this methodology apply to REST payment APIs?▼

No, the payloads and probes are written for GraphQL mutations, aliases, and schema introspection. Concepts like idempotency replay and source-account IDOR generalize conceptually, but the concrete test syntax requires a GraphQL endpoint.

What evidence is required to report a fintech GraphQL vulnerability?▼

You must demonstrate an actual ledger state change, such as a balance difference before and after the mutation, not just a success response. Race-condition findings should be reproduced twice from a clean state, and captures must redact real account numbers and PII.

Related Skills

Explore More Software Engineering Skills→
sayseven7sayseven7
11

graphql-and-hidden-parameters

Probe GraphQL schemas and enumerate hidden request parameters for security assessments.

Community
Intermediate
marcboggsmarcboggs

report-writing

Writes impact-first bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi with CVSS scoring.

Community
Intermediate
Carlos-Reyes-UTPCarlos-Reyes-UTP
2

hunt-race-condition

Test one-time business logic endpoints for duplicate effects under concurrent request timing.

Community
Intermediate
devtintdevtint

graphql-security

Test GraphQL API endpoints for introspection leaks and query complexity vulnerabilities.

Community
Intermediate