I've been making N20k every second in lagos life game.
There's a bug in the system, you can modify the game state and send it to the server through PUT /api/save.
Here's the game flow which has the vulnerability;
Browser
│
│ GET /api/save
▼
Server
│
│ returns current game state
▼
Browser
│
│ modifies https://t.co/9s3RsRqcUv
▼
Browser
│
│ PUT /api/save
│ { game: modifiedGame }
▼
Server
│
│ saves supplied state
▼
Database
Seems earlier @Shalom_HeyEliy uses updatedAt to solve the problem, but still doesn't, user can request the updatedAt stamp, and resubmit with it but with modified https://t.co/9s3RsRqcUv value, below is a video proof.