Hello my buddy,
Some day ago, I was try to trigger a website in Viet Name, and I detected the IDOR bug on that web. More than so far, I found not only username, also password of user and admin account. So many money in user wallet. 
There are samples for that: https://gofile.io/d/C9Z1Eh