“Resume” Function Allows Users to Resubscribe Without Paying Previous Bills
Platform: ArcBlock Launcher URL: https://launcher.arcblock.io/app/u/apps/ Date Reported: October 10, 2025 Severity: High Category: Billing / Subscription Logic / Access Control
Description:
The “Resume” button in the Apps Management section of ArcBlock Launcher allows users to reactivate (resubscribe) their applications without paying outstanding or previous subscription fees. This creates a payment bypass vulnerability, allowing continued access to paid app services without proper billing enforcement.
Steps to Reproduce:
- Go to https://launcher.arcblock.io/app/u/apps/.
- Log in to a user account with an expired or unpaid app subscription.
- Locate the expired app in the list.
- Click “Resume”.
- Observe that the app successfully resumes or reactivates without prompting for payment of the previous unpaid balance.
Expected Result:
- The system should block resubscription until all previous unpaid bills are cleared.
- Users should be redirected to a payment confirmation page or billing settlement before reactivation.
Actual Result:
- The “Resume” button allows immediate reactivation of the app.
- No payment prompt or billing verification appears.
- The user regains access to paid services without settling previous dues.
Impact:
- Financial loss for the platform due to unpaid or skipped subscription cycles.
- Integrity risk in the billing system.
- Exploitation potential if users repeatedly resume subscriptions without paying.
Affected Module:
- App Management → Resume Subscription Function
- Possibly related to Billing API / Payment Enforcement Logic
Possible Cause (Hypothesis):
- Missing backend validation for unpaid invoices before resuming subscriptions.
- Incorrect or missing linkage between billing and subscription state management.
- Resume button frontend not triggering payment verification API.
Suggested Fix:
- Enforce payment status verification on “Resume” actions.
- Add backend checks for unpaid invoices before allowing reactivation.
- Display payment required modal when attempting to resume with outstanding balances.
- Audit billing workflow for similar logic bypasses (e.g., pause, renew, or upgrade actions).