Client
B2B marketplace
Service
Web & API penetration test
Location
Undisclosed
The payout flow trusted a webhook. The webhook could be sent twice.
The Challenge
Signature verification answers one question: did this message come from the expected sender. It does not answer whether this message has already been processed.
Without a nonce, a timestamp window or idempotency on the receiving side, a valid signed message stays valid forever. In a payout flow that means the same instruction can be replayed, and the ledger has no reason to object.
The Approach
We captured a legitimate signed callback in a test environment and resubmitted it. It was accepted.
We then checked the surrounding handlers for the same assumption and reported the pattern rather than the single endpoint, because a replay defence that covers one handler and not its siblings is not a defence.
The Outcome
Idempotency keys were added at the handler and a replay window was enforced on the signature.
We retested the flow and the sibling handlers after the fix. Recorded as RETESTED in 2026.
Case Studies
