How I Got Hall Of Fame In Sorare Web 3.0 At Hackerone ⚡

Aug 20, 2025 4 min read Utsavpari Gosai

Hello Hackers! 👋

Blog Image

I hope you all are well. Today I’m sharing a short bug bounty story about how I found a resource-consumption (DoS) issue on Sorare — and later got the reputation points and my name listed in their Web 3.0 Hall of Fame on HackerOne. 🚀

Blog Image

About Sorare 🌐

Sorare is a global fantasy football platform that mixes fantasy leagues, digital trading cards, and blockchain (NFT) technology. It’s an interesting target because many endpoints serve user and NFT-related data, and availability is important for the platform’s user experience.

What I Found 🔍

While browsing Sorare’s public web endpoints, I noticed an endpoint that accepted very long URL path segments. By sending a request with an extremely long path component, the server responded slowly and eventually returned HTTP 503 Service Unavailable — indicating resource exhaustion on that endpoint. This looked like a classic resource-consumption (DoS) condition caused by unbounded input handling.

Here is a trimmed and safe-to-read representation of the request I used to reproduce the behaviour (the real request contained a very long repeated segment):

GET /api/v1/users/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa...
Host: etc.sorare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: ...
Accept-Encoding: gzip, deflate, br
Connection: close

Note: above is intentionally shortened for readability. The actual test used a much longer repeated path segment which triggered the resource consumption behaviour and led to 503 responses from the server.

Response Observed

When the long request was sent, the endpoint returned 503 and the service became temporarily unavailable for that route. Repeating large numbers of such requests increased load and caused degraded responses — a denial of service risk for the platform if an attacker automated it.

Responsible Disclosure & Outcome ✅

I reported the issue via Sorare’s HackerOne program with a clear, responsible disclosure: description, reproduction steps (kept high-level and responsible), and recommended mitigation (validate and limit URL path segment length; rate-limit and add input size checks). The Sorare engineering team acknowledged the report and validated the issue.

Sorare later listed my contribution in their Web 3.0 Hall of Fame on HackerOne — that was a proud moment. 🙏 I’m grateful they took the report seriously and fixed the underlying input handling so the endpoint could no longer be abused for resource exhaustion.

What You Can Learn

  • Always validate and limit input size on the server side (path segments, headers, bodies).
  • Implement rate-limiting and proper error handling to avoid returning server errors that indicate exhausted resources.
  • When reporting, be responsible: provide enough detail to reproduce but avoid publishing exploit scripts or exact attack automation publicly.

If you have questions about responsible disclosure, fuzzing techniques (high-level), or how to write a clear HackerOne report — feel free to ask. I’m happy to help or clarify. 🤝

Thank You,
MR.X FACTOR

🔗 Handles:

← Back To Homepage