zakirkun Race Condition in Purchase / Financial Transaction
Overview
A race condition in financial transactions allows attackers to send multiple concurrent requests to:
- Withdraw more funds than available balance
- Buy more items than stock allows
- Redeem the same voucher/coupon multiple times
- Use the same gift card balance repeatedly
This is a time-of-check/time-of-use (TOCTOU) vulnerability at the database level.
Remediation
- Use database-level row locking (
SELECT ... FOR UPDATE) - Use optimistic locking with version counters
- Use atomic operations (
UPDATE balance SET balance = balance - amount WHERE balance >= amount) - Use idempotency keys for payment APIs