{"amount":"1","note":"state-changing GET with no CSRF protection","success":true,"to":"attacker"}