A time-of-check/time-of-use race in provider accounting allows unbounded free service
- Severity
- High
- Class
- Value integrity
- System
- On-chain voucher marketplace
Concurrent requests race the accounting that should meter usage, letting an attacker consume unlimited service while paying nothing.
The accounting that debits a voucher checked the balance and then used the service as two separate steps, with a window in between. Fire many requests into that window at once and they all pass the check against the same balance before any of them debits it.
In my proof-of-concept every one of a hundred concurrent requests was served while nothing was actually claimed against the voucher.
Why it rated High
Unbounded theft of service — the provider does the work and is never paid — driven by ordinary concurrency, no special access needed.
The fix class
Make the check-and-debit atomic so concurrent requests can't all pass against the same balance.
