Exploiting a lost-update race between battle and upgrade operations in a Supabase game

I used Codex to investigate a browser game’s normal-player API surface. The main exploit was a cross-feature lost-update race: an upgrade and battle read the same balance, the upgrade committed the stronger stats and deducted the coins, then the slower battle restored the stale balance while preserving the upgrade. The write-up includes the failed...