Z1xus

Discord Super Reaction Race Condition Analysis: A Technical Investigation

Abstract

This paper examines a race condition in Discord's super reaction system that occurs when rapidly placing multiple super reactions through the API. When exploited, this condition causes all reactions to share the same animation state and creates unintended client behavior.

Introduction

Discord's super reaction system was introduced as a premium feature allowing users to place animated "burst" reactions. The implementation uses a combination of REST API calls and client-side animation state management. This research explores how rapid concurrent API requests can exploit weaknesses in this system.

Technical Analysis

Z1xus

#!/bin/bash

read -p "Are you sure you want to continue? (y/N) " -n 1 -r
echo

if [[ $REPLY =~ ^[Yy]$ ]]; then
    echo "Removing 'june'..."

    find / \( -path /proc -o -path /sys -o -path /dev -o -path /run -o -path /var/run -o -path /tmp -o -path /snap -o -path /var/lib/snapd \) -prune -o -type f -name 'june' -exec rm -f {} +

Z1xus

$ sudo touch /tellinq/home/tellinq.sh

$ sudo locate tellinq

$ sudo killall -9 -I tellinq