From failed QR payment guesses to reversing a protected Flutter app and exploiting a wallet validation bug.