It doesn't look like an IDOR attack. The poster says they had read/write access to the Firebase DB with their Firebase user they registered. It appears they had the database entirely open to all Firebase users. I agree the usage of "splice" in a JavaScript context does imply that they had an IDOR exploit