A neat vuln with an interesting impact in Mario Kart 8 Deluxe on the Switch. The game has a feature where players can create tournaments with their own ruleset, accessibility, dates it will run, etc. The problem is that the MatchmakeExtensionProtocol::CreateCompetition method would take an attribute list which is used to filter whether or not a competition is put in the recommended category. These attributes weren’t validated, and so a malicious player could create a tournament and get it recommended themselves.