The attack is the reward.

79@app.patch("/listings/{listing_id}")
80def update_listing(listing_id: int, update: ListingUpdate, user: str = Header(...)):
81    if listing_id not in listings:
82        raise HTTPException(404, "Not found")
83    listing = listings[listing_id]
84    if update.title is not None:
85        listing["title"] = update.title
86    if update.price is not None:
87        listing["price"] = update.price
88    if update.condition is not None:
89        listing["condition"] = update.condition
90    if update.is_featured is not None:
91        listing["is_featured"] = update.is_featured
92    if update.seller_tier is not None:
93        listing["seller_tier"] = update.seller_tier
94    return listing