Website vulnerability and penetration testing (glitch/exploit finding)

Hi. I have recently purchased a Counter Strike Global Offensive gambling website. The premise is simple: a user deposits "weapon skins" which are converted to a currency which is then used to gamble on the site. Authentication and login is handled by Steam. We take data from a number of different API's - one to pull in data about the skins and another to calculate the cost of said skins on the marketplace. Different skins cost different amounts; the higher the value of the skin, the greater the currency that is deposited in the users account with which to gamble. As I have recently acquired this website, I require a full security audit testing for glitches, exploits and vulnerabilities. I am aware that this website has suffered from these in the past but I have assured these have been patched. Any successful candidate should have an understanding of the Steam/Valve authentication process and if you have come across these gambling websites before, so much the better. Candidates will be paid bonuses for detailing glitches, exploits and hacks from a user perspective that have the potential to become severe security issues. The exploit/glitch should be detailed and should be clearly demonstrable along with ideas on how to patch. Successful candidates will be given the website URL and then told to work on finding the exploits. In this first round I want to see what exploits/glitches can be found as a random user, before I let you look under the hood. If we have a good working relationship in the first phase I will look to extend our relationship should you wish. Website is using API, javascript and server-side commands. Look forward to working with you.