Race Condition Hackviser Jun 2026
def redeem_coupon(user_id, code): coupon = db.query("SELECT * FROM coupons WHERE code = %s", code) if coupon and not coupon.used: # RACE WINDOW: another request can read 'used=False' here time.sleep(0.05) # artificial delay increases race window db.execute("UPDATE coupons SET used = TRUE WHERE code = %s", code) db.execute("UPDATE users SET balance = balance + coupon.value WHERE id = %s", user_id) return "Success" return "Invalid or used coupon"
# Wait for them to finish for t in threads: t.join() race condition hackviser
target_url = "http://target.hackviser.com/api/transfer" def redeem_coupon(user_id, code): coupon = db