What problem does it solve? Fintech GraphQL APIs sit in front of ledgers, wallets, and payment systems where a single resolver bug can move real money, yet generic GraphQL testing guidance misses the financial-specific attack surface like idempotency replay, decimal rounding abuse, and source-account authorization gaps. ## Core Features & Use Cases - Money-Movement Mutation Testing: Systematically map and probe transfer, withdrawal, redemption, and top-up mutations for non-atomic ledger writes, idempotency-key bypass, and double-spend via alias batching. - Decimal & Precision Abuse Probes: Test custom Money/Decimal scalars with sub-cent amounts, scientific notation, oversized values, and negative amounts to expose rounding drift and float-parsing fallbacks. - Fintech-Specific Authorization Checks: Detect asymmetric IDOR where source-account ownership is never validated, field-level PII leaks on nested KYC fields, and admin-tier mutations reachable via mass assignment. - Use Case: When hunting a neobank or brokerage target exposing a GraphQL endpoint, use this skill after generic schema discovery to test whether a transferFunds mutation validates that the source account belongs to the caller, and whether replaying an idempotency key produces duplicate ledger writes. ## Quick Start Ask the AI to hunt fintech-specific GraphQL vulnerabilities on an authorized banking or payments target that exposes money-movement mutations.
