VenomStore logic vuln - PoC

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

API key extracted from frontend. Anon Supabase key.
Gives access to RPC functions and tenant data.

Wheel endpoint:
OPTIONS /functions/v1/retail-mini-app-serve
action=spin_fortune_wheel
bot_id=4f0355aa-9791-4912-9136-917f2658188d

Exploitation:
spin → intercept → drop confirmation → spin again
repeat until desired reward
forward request → reward applied

Replay:
send multiple confirmations simultaneously
no idempotency checks
each request applies independently

Admin UUID:
231c5a03-7418-4c05-bfcf-23952a31fbd0

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

PoC: GitHub - veilcore01/VenomStore-vuln-PoC
Bot: @VenomEuropeBot
Channel: nocivics
Contact: @NOCIVICS_CORE01

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━