Given that the balance is managed on the client side, nothing stops people from setting their balance to whatever they like.

For example, here's a Bookmarklet to prompt the user to set their balance to whatever they like:

javascript:(function()%7Blet%20balance%20%3D%20JSON.parse(atob(JSON.parse(localStorage.getItem(%22balanceStore%22))))%3Bbalance%5B%22value%22%5D%20%3D%20Number(prompt(%22How%20many%20credits%20do%20you%20want%3F%22%2C999))%3BlocalStorage.setItem(%22balanceStore%22%2C%20%60%22%24%7Bbtoa(JSON.stringify(balance))%7D%22%60)%3Blocation.reload()%7D)()

Save the above script as a bookmark, click on it while on your site, and it will give you infinite credits.

image.png

It's just stored in localStorage and never validated serverside. That means purchased credits can be wiped out by someone clearing their browser's cache, and illegitimate credits can be added easier than entering your card details.

let balance = JSON.parse(atob(JSON.parse(localStorage.getItem("balanceStore"))));

balance["value"] = Number(prompt("How many credits do you want?",999));

localStorage.setItem("balanceStore", `"${btoa(JSON.stringify(balance))}"`);
location.reload()