Hunt Fintech Graphql

Hunt Fintech GraphQL is an authorized security-testing methodology for GraphQL backends that move money, extending generic GraphQL bug classes (IDOR, mass assignment, introspection, batching abuse) into the specific risk class fintech ledgers create: a resolver bug that leaks data in a normal SaaS app moves money here. It opens with a mandatory confirmation gate requiring the user to state the exact target, confirm written authorization and scope, and explicitly approve any command before it probes, exploits, or extracts data - staying read-only and defensive-only otherwise.

The skill frames three properties that make fintech GraphQL a distinct surface: money-movement mutations like transferFunds or redeemRewards typically trigger multiple ledger writes (debit, credit, fee) that must be atomic, and GraphQL's flexible input and alias batching make those writes easy to desynchronize; amounts and rates are attacker-controlled scalar input rather than display formatting, so how a resolver parses and rounds a Money/Decimal scalar is itself exploitable surface; and KYC/PII fields such as ssnLast4, routingNumber, or kycStatus commonly sit on the same User/Account type as routine fields, so one missing field-level authorization check fans out to every query touching that type.

Its step-by-step methodology maps every mutation that touches balance (including indirect ones like redeemRewards, closeAccount, or disputeTransaction), identifies whether a mutation produces one ledger write or several, tests idempotency-key handling by replaying an identical mutation, probes decimal and precision edge cases (sub-cent amounts, scientific notation, oversized values, negative amounts) to catch rounding mismatches, and checks the fintech-specific asymmetric IDOR where a transfer mutation validates the destination account but not that the source account belongs to the caller. It also checks field-level authorization on nested PII fields (a transaction's embedded counterparty object is a common place the check goes missing), looks for admin-shaped fields reachable via mass assignment, tests currency-argument consistency for FX-rate TOCTOU windows, and combines alias batching with money-movement mutations to test for double-spend.

A Gate 0 validation section sets a stricter evidence bar than a typical GraphQL finding: a real finding needs a demonstrated before/after ledger state change, a race/double-spend finding must be reproduced from a clean state rather than claimed from a timing fluke, and a verbose error message alone (not an actual value or data exposure) belongs to a different finding class entirely.

Use it when you have explicit written authorization to assess a fintech GraphQL target within a bug-bounty or penetration-test engagement, and the task matches money-movement, ledger, or fintech-specific field-authorization vulnerability classes. It assumes hunt-graphql's generic discovery and introspection methodology has already run or is run first to obtain the schema.

Do not use it without written, in-scope authorization - the confirmation gate blocks any active probing or exploitation until target, scope, and command are confirmed in the conversation. It is a docs-only methodology import: it does not bundle upstream executable helper scripts, commands, or a scanning engine.

Input is an authorized fintech GraphQL target's schema (from prior introspection) plus the tester's confirmed scope. Output is a set of test payloads and a methodology for money-movement mutations, decimal/precision probes, idempotency replay tests, source-account authorization checks, nested PII field queries, and mass-assignment probes, together with the Gate 0 validation criteria a finding must clear before it is reported.

Authorized penetration testers and bug-bounty researchers assessing fintech applications whose GraphQL backends move money - people who already know generic GraphQL hunting and need the fintech-specific delta: ledger atomicity, decimal precision, asymmetric source/destination authorization, and field-level PII exposure.