We put a $300 bounty on Pink's AI agent spending rules. It was gone by lunch

Description and use

During a public challenge, three edge‑case bugs in Pink Agentic AI Payments allowed bypassing spending rules: a trailing space in the currency code, UTC vs. workspace time mismatch, and decimal rounding differences. Fixes were applied, though a split‑payment gap remains.

Problem

Pink Agentic AI Payments’ spending rules were bypassed by simple input edge cases, allowing unauthorized payments.

Outcome

All three bounty wins were achieved within 4.5 hours using simple curl requests that exploited currency padding, UTC vs. workspace time, and rounding mismatches.

Workflow

• 1. Submit payment request via REST API. 2. Server validates currency against allow‑list. 3. Server checks time rules using workspace timezone. 4. Server compares amount with exact precision. 5. If all checks pass, issue single‑use credential.
• 6. Client uses credential to execute payment.

Evidence

One of our rules says payments over $1,000 need CFO approval. The reporter sent a EUR 999 payment, except the currency field was "EUR ", with a trailing space.

Source

We had a rule that read "outside 06:00 to 23:00 SGT, finance on-call decides." The rule was written in Singapore time. The server checked it in UTC.

Source

One of our rules auto-allows anything at or under $500. A payment of $500.0001 cleared it. Why: the rule compared against the amount rounded to the cent, but the credential that actually got issued carried the unrounded figure.

Source