> For the complete documentation index, see [llms.txt](https://shadowforge.gitbook.io/shadowforge-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shadowforge.gitbook.io/shadowforge-writeups/bugforge.io/readme.txt/daily-labs/broken-logic/cheesy-does-it-1.md).

# Cheesy Does It

> We're getting ready to order some free pizza's with the hint ***broken logic.***

I thought I had it all figured out, I found a bug where I was able to tamper with the payment and made sure my pizza was free of charge. All though this was a legit bug, it wasn't the thing I was looking for. 

<figure><img src="/files/jsyJphKliBMA359FT0Dq" alt=""><figcaption></figcaption></figure>

The thing I was looking for turned out to be on the refund endpoint. When hitting `orders/2/refund` I could change the variable `refund_amount` in the POST request to any value I wanted.

<figure><img src="/files/hoFuzR8POPAWbaJhaur4" alt=""><figcaption></figcaption></figure>

And when I claimed an amount that I wasn't entitled to, I received my flag 🇧🇪