pull down to refresh

you can perform this attack with a single transaction