Business LogicMediumTOCTOUConcurrency bugs
Race Conditions
Concurrent requests exploit the gap between a check and its use to bypass limits.
Overview
When state is read, validated, then acted upon non-atomically, firing many parallel requests (single-packet attack) lets multiple succeed against a one-time check - redeeming a coupon or withdrawing balance repeatedly.
How it works
When state is read, validated, then acted upon non-atomically, firing many parallel requests (single-packet attack) lets multiple succeed against a one-time check - redeeming a coupon or withdrawing balance repeatedly.
Example
Impact
Double-spend, limit/quota bypass, duplicate provisioning, and balance manipulation.
Detection
Fire synchronized concurrent requests at limited actions and detect multiple successes beyond the intended cap.
Prevention
- Make check-and-act atomic (DB transactions, SELECT ... FOR UPDATE, unique constraints).
- Use idempotency keys for sensitive operations.
- Apply per-resource locks or atomic counters.