Spatial.io — client-side feature gate bypass (high-level)

What this is

High-level rewrite of a 2022 research note on Spatial (Android / VR clients). The finding concerned Pro / paid feature unlocks enforced primarily in the React Native index.android.bundle, with insufficient server-side entitlement verification. PoC paths and patch diffs are omitted.

Vulnerability class (concept)

• Client-side trust: entitlement flags and UI/host settings gated in downloadable JavaScript that can be altered on a rooted or repackaged client (“cracking” / local code patch themes).
• Missing server profile enforcement: features that should require a paid subscription were reachable once local checks flipped, if the backend did not re-validate the user’s plan.
• Unobfuscated RN bundles increase ease of locating gate logic; obfuscation alone is not a fix.

Impact (abstract)

Users could unlock paid capabilities without purchase, causing direct revenue loss and unfair access on mobile and related VR builds that share the same client logic.

Mitigations / what to check

• Enforce subscriptions and entitlements on the server for every privileged action and room/host setting; treat client flags as display-only.
• Obfuscate/encrypt RN bundles only as abuse-friction; assume determined clients can patch them.
• Monitor entitlement mismatches (client claims Pro, billing says Free).
• Apply Play Integrity / attestation where appropriate—as signals, not sole controls.

Solve steps and PoC omitted.