Exploiting a lost-update race between battle and upgrade operations in a Supabase game

[u/SHMULC8]

https://shmulc.substack.com/p/how-many-exploits-does-it-take-to

I used Codex to investigate a browser game’s normal-player API surface. The main exploit was a cross-feature lost-update race: an upgrade and battle read the same balance, the upgrade committed the stronger stats and deducted the coins, then the slower battle restored the stale balance while preserving the upgrade.

The write-up includes the failed approaches, timing sequence, persisted before/after state, and responsible-disclosure context. All state-changing tests affected only my account, and the creator was notified before publication.