4 ms·
That seems vulnerable to a version of the Scientology bestseller exploit. Let's say the seller is selling widgets. They get their phantom accounts to buy the w
by someguyorother 5y ago
That seems vulnerable to a version of the Scientology bestseller exploit.
Let's say the seller is selling widgets. They get their phantom accounts to buy the widgets and thus run up the lifetime spend counter. Then they give the "purchased" widgets to themselves and just keep on selling them.
All they have to pay per iteration is the overhead (Amazon's take), assuming they'll manage to clear their stock later.
E.g. say a widget costs $110, of which Amazon's take is $10.
The seller uses their fake account to buy 10 widgets at a total cost of $1100. The seller both receive the widgets (shipped to the fake account's address) and the $1000 from the "sale". The total cost is thus $100 for making the fake account look like it has spent $1000.