diff --git a/backend/requests/lootboxes.http b/backend/requests/lootboxes.http
index 2c7fe2e..126d237 100644
--- a/backend/requests/lootboxes.http
+++ b/backend/requests/lootboxes.http
@@ -2,3 +2,8 @@ GET http://localhost:8080/lootboxes
 Authorization: Bearer {{token}}
 Content-Type: application/json
 
+###
+
+POST http://localhost:8080/lootboxes/1
+Authorization: Bearer {{token}}
+Content-Type: application/json
\ No newline at end of file
diff --git a/backend/src/main/java/de/szut/casino/CasinoApplication.java b/backend/src/main/java/de/szut/casino/CasinoApplication.java
index 2499781..4b47f5c 100644
--- a/backend/src/main/java/de/szut/casino/CasinoApplication.java
+++ b/backend/src/main/java/de/szut/casino/CasinoApplication.java
@@ -33,12 +33,12 @@ public class CasinoApplication {
             if (lootBoxRepository.count() == 0) {
                 LootBoxEntity basicLootBox = new LootBoxEntity();
                 basicLootBox.setName("Basic LootBox");
-                basicLootBox.setPrice(new BigDecimal("1.99"));
+                basicLootBox.setPrice(new BigDecimal("2"));
                 basicLootBox.setRewards(new ArrayList<>()); // Initialize the list
 
                 LootBoxEntity premiumLootBox = new LootBoxEntity();
                 premiumLootBox.setName("Premium LootBox");
-                premiumLootBox.setPrice(new BigDecimal("4.99"));
+                premiumLootBox.setPrice(new BigDecimal("5"));
                 premiumLootBox.setRewards(new ArrayList<>()); // Initialize the list
 
                 // Save the loot boxes first
@@ -46,27 +46,27 @@ public class CasinoApplication {
 
                 RewardEntity commonReward = new RewardEntity();
                 commonReward.setValue(new BigDecimal("0.50"));
-                commonReward.setProbability(new BigDecimal("70.00"));
+                commonReward.setProbability(new BigDecimal("0.7"));
 
                 RewardEntity rareReward = new RewardEntity();
                 rareReward.setValue(new BigDecimal("2.00"));
-                rareReward.setProbability(new BigDecimal("25.00"));
+                rareReward.setProbability(new BigDecimal("0.25"));
 
                 RewardEntity epicReward = new RewardEntity();
                 epicReward.setValue(new BigDecimal("5.00"));
-                epicReward.setProbability(new BigDecimal("5.00"));
+                epicReward.setProbability(new BigDecimal("0.5"));
 
                 RewardEntity premiumCommon = new RewardEntity();
                 premiumCommon.setValue(new BigDecimal("2.00"));
-                premiumCommon.setProbability(new BigDecimal("60.00"));
+                premiumCommon.setProbability(new BigDecimal("0.6"));
 
                 RewardEntity premiumRare = new RewardEntity();
                 premiumRare.setValue(new BigDecimal("5.00"));
-                premiumRare.setProbability(new BigDecimal("30.00"));
+                premiumRare.setProbability(new BigDecimal("0.3"));
 
                 RewardEntity legendaryReward = new RewardEntity();
                 legendaryReward.setValue(new BigDecimal("15.00"));
-                legendaryReward.setProbability(new BigDecimal("10.00"));
+                legendaryReward.setProbability(new BigDecimal("0.10"));
 
                 // Save all rewards
                 rewardRepository.saveAll(Arrays.asList(
@@ -75,10 +75,9 @@ public class CasinoApplication {
                 ));
 
                 // Add relationships from the owning side (LootBox)
-                basicLootBox.getRewards().add(rareReward);
-                basicLootBox.getRewards().add(epicReward);
+                basicLootBox.getRewards().add(commonReward);
+                basicLootBox.getRewards().add(premiumRare);
 
-                premiumLootBox.getRewards().add(commonReward);
                 premiumLootBox.getRewards().add(premiumCommon);
                 premiumLootBox.getRewards().add(premiumRare);
                 premiumLootBox.getRewards().add(legendaryReward);
diff --git a/backend/src/main/java/de/szut/casino/lootboxes/LootBoxController.java b/backend/src/main/java/de/szut/casino/lootboxes/LootBoxController.java
index c885b5d..716b02a 100644
--- a/backend/src/main/java/de/szut/casino/lootboxes/LootBoxController.java
+++ b/backend/src/main/java/de/szut/casino/lootboxes/LootBoxController.java
@@ -1,20 +1,76 @@
 package de.szut.casino.lootboxes;
 
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.RestController;
+import de.szut.casino.user.UserEntity;
+import de.szut.casino.user.UserRepository;
+import de.szut.casino.user.UserService;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
 
+import java.math.BigDecimal;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
+import java.util.Optional;
 
 @RestController
 public class LootBoxController {
     private final LootBoxRepository lootBoxRepository;
+    private final UserRepository userRepository;
+    private final UserService userService;
 
-    public LootBoxController(LootBoxRepository lootBoxRepository) {
+    public LootBoxController(LootBoxRepository lootBoxRepository, UserRepository userRepository, UserService userService) {
         this.lootBoxRepository = lootBoxRepository;
+        this.userRepository = userRepository;
+        this.userService = userService;
     }
 
     @GetMapping("/lootboxes")
     public List<LootBoxEntity> getAllLootBoxes() {
         return lootBoxRepository.findAll();
     }
+
+    @PostMapping("/lootboxes/{id}")
+    public ResponseEntity<Object> purchaseLootBox(@PathVariable Long id, @RequestHeader("Authorization") String token) {
+        Optional<LootBoxEntity> optionalLootBox = lootBoxRepository.findById(id);
+        if (optionalLootBox.isEmpty()) {
+            return ResponseEntity.notFound().build();
+        }
+
+        LootBoxEntity lootBox = optionalLootBox.get();
+        RewardEntity reward = determineReward(lootBox);
+
+        Optional<UserEntity> optionalUser = userService.getCurrentUser(token);
+        if (optionalUser.isEmpty()) {
+            return ResponseEntity.notFound().build();
+        }
+
+        UserEntity user = optionalUser.get();
+
+        if (user.getBalance().compareTo(lootBox.getPrice()) < 0) {
+            Map<String, String> errorResponse = new HashMap<>();
+            errorResponse.put("error", "Insufficient balance");
+            return ResponseEntity.badRequest().body(errorResponse);
+        }
+
+        user.setBalance(user.getBalance().subtract(lootBox.getPrice()));
+        user.setBalance(user.getBalance().add(reward.getValue()));
+        userRepository.save(user);
+
+        return ResponseEntity.ok(determineReward(lootBox));
+    }
+
+    public RewardEntity determineReward(LootBoxEntity lootBox) {
+        double randomValue = Math.random();
+        BigDecimal cumulativeProbability = BigDecimal.ZERO;
+
+        for (RewardEntity reward : lootBox.getRewards()) {
+            cumulativeProbability = cumulativeProbability.add(reward.getProbability());
+            if (randomValue <= cumulativeProbability.doubleValue()) {
+                return reward;
+            }
+        }
+
+        return lootBox.getRewards().getLast();
+    }
+
 }
diff --git a/backend/src/main/resources/application.properties b/backend/src/main/resources/application.properties
index e42fba6..a02bc80 100644
--- a/backend/src/main/resources/application.properties
+++ b/backend/src/main/resources/application.properties
@@ -2,7 +2,7 @@ spring.datasource.url=jdbc:postgresql://${DB_HOST:localhost}:5432/postgresdb
 spring.datasource.username=postgres_user
 spring.datasource.password=postgres_pass
 server.port=8080
-spring.jpa.hibernate.ddl-auto=create-drop
+spring.jpa.hibernate.ddl-auto=update
 stripe.secret.key=${STRIPE_SECRET_KEY:sk_test_51QrePYIvCfqz7ANgqam8rEwWcMeKiLOof3j6SCMgu2sl4sESP45DJxca16mWcYo1sQaiBv32CMR6Z4AAAGQPCJo300ubuZKO8I}
 stripe.webhook.secret=whsec_746b6a488665f6057118bdb4a2b32f4916f16c277109eeaed5e8f8e8b81b8c15
 app.frontend-host=http://localhost:4200