Chalk Infinite Course Election Coins Bug Analysis
Chalk is a course selection platform that uses "Course Coins" for students to choose their classes. Unlike traditional platforms where students have to quickly grab available slots for courses, Chalk determines course admission through a lottery based on the amount of Course Coins students bid. This opens up the possibility for bugs to appear and for manipulation of the Course Coins.
Disclaimer: This document is intended solely for technical discussion and educational purposes. The reader is advised against attempting to reproduce the bug. The author disclaims all responsibility for any adverse effects that may arise from using this information.
Procedures
- Download Postman and Postman Interceptor Chrome Extension
- Open course selection page, remove all your existing courses, then select courses you desire. Fill appropriate amount of coins for each course, ensuring that there are minimum 99 coins (or your desired value) after filling all the courses.
- Open Postman Intercept extension and start capturing.
- Submit courses. Then stop the capture.
- Open Postman and select "Requests" Tab.
- Find the
POSTrequest with URL ended in$batch
- In the request detail tab, select Body tab. Using
⌘F/Ctrl-Fto open search panel and look for keywordcoins.
- Change the value of
coinsto 99, or your desired value (must within the range of your remaining coins)
- Send the request. Response should show "Success"
- Now go back to the webpage and refresh. You should see new courses are created with new values.
- Remove the courses with old values. You may notice that the newly added 99 coins course is actually removed from the list. However, there is no need to panic as the removed course will be displayed correctly after refreshing the page.
- (Optional) To make sure your courses are updated, open Chrome Dev Tools and select Network panel. Select
Fetch/XMRfilter. Find the request ending withquery. You should see the coins are 99.
Info: If you send multiple requests, the corresponding number of course will be shown. However, this action is not recommended because it might result in unexpected behavior.
