Race
One coupon, thirty-seven redemptions, forty milliseconds
Check and decrement separated by a network call. Textbook TOCTOU, confirmed with an HTTP/2 single-packet burst.
· 2 min read $500 - $1k
Race
A webhook that could be replayed for eleven minutes
The signature was verified, the timestamp was not, and the idempotency key was checked after the credit was applied.
· 2 min read $500 - $1k