Applications

Race-Condition Double Spend

Two or more requests arrive in a timing window where the application validates the same balance, credit or coupon before either operation has committed.

RedMawJuly 10, 2026

Definition

A race condition in a transactional workflow arises when validation and commitment are separated in time, and concurrent requests can both pass validation against the same pre-commit state.

Why sequential testing misses it

Tested one at a time, the logic is correct: the balance is checked, the operation proceeds, the balance is updated. The defect only appears when requests overlap, which ordinary functional testing and most scanning never attempt.

State worth testing concurrently

Balances, wallets and stored credit
Single-use coupons, vouchers and referral rewards
Inventory and seat reservations
Withdrawal, transfer and refund operations
Rate-limited or quota-bound actions

Where it leads

User
Concurrent Requests
State Race
Duplicate Action
Financial Impact

Each hop validated by successful exploitation

How RedMaw validates this attack

Validation runs only inside authorized scope, with agreed exploitation limits.

01Identify operations where validation and commitment are separable
02Issue overlapping requests against the same state within scope
03Establish whether the resulting state is internally inconsistent
04Preserve timing, requests and final state as evidence

Keep going

Capabilities

Application SecurityAdversarial testing of the web applications and APIs you own and authorize, aimed at proving exploitability rather than reporting resemblance to a known pattern.

Use cases

Security validation

Stop assuming you are secure. Prove it.

Continuously test what an attacker can actually reach across your applications, SaaS identities, internal infrastructure and AI systems.

Request a demo Explore the platform