Loading page
Review the challenge brief, files, and requirements.
The transfer endpoint at POST /api/transfer checks your balance and debits it in separate steps, so concurrent requests can race the ledger.
Send overlapping transfers until the account goes negative and recover the flag.
Sign in to attempt this challenge.
Use Proving Grounds to continue your challenge practice.
Open Proving Grounds