New API: Integer overflow in quota billing yields negative charges (self-crediting)

Summary

Multiple billing paths multiplied user-controlled quantity parameters into the quota calculation without an upper bound or overflow-safe integer conversion. A crafted extreme value (e.g. image n = 18446744073686646784, a wrapped-negative accepted by a *uint field) makes conversions like int(float64(quota) * n) wrap past the int64/int32 range into a large negative quota. The negative quota takes effect at settlement (not at pre-consume), where it is equivalent to crediting the user's balance — turning a small positive balance into an enormous one.

Timeline（UTC+8）

This vulnerability was confirmed exploited in the wild. Response timeline (UTC+8):

• 2026-07-06 23:00 — Community user @lihui12388 reported that their deployment had been exploited via this vulnerability (large negative consumption entries in logs and abnormally inflated balances). We confirmed in-the-wild exploitation and started an emergency response immediately.
• 2026-07-07 01:17 — Emergency fix released as v1.0.0-rc.18, roughly 2 hours after the report.
• 2026-07-07 (next day) — Given the confirmed active exploitation, we publicly disclosed the vulnerability and the fixed version to the community the following day so that all operators could upgrade and audit promptly.
• 2026-07-07 13:19 — v1.0.0-rc.19 released with additional observability (quota-saturation warning logs) to help operators audit and monitor abuse.

Preconditions

This is not a zero-balance freebie. The attacker must hold an account whose wallet balance is > 0 and at least covers the request's normal (un-inflated) pre-consume amount — the pre-consume gate rejects userQuota <= 0 and insufficient balance with HTTP 403. Quantity multipliers (n, duration, ...) are not applied at pre-consume; the overflow only manifests at settlement, flipping the charge negative and crediting the balance.

Severity escalates when the deployment enables any feature that grants free starting balance, because the required positive balance is then obtained at zero cost and at scale: check-in rewards (CheckinSetting.Enabled), invite rebates (QuotaForInviter / ), or new-user quota gifts (). With self-registration on by default and any of these enabled, an attacker can register (or mass-register) to obtain seed balance for free, then inflate it via a single crafted request — effectively unauthenticated exploitation.