sc-race-condition

SC: Race Conditions / TOCTOU

Purpose

Detects race condition vulnerabilities where concurrent operations on shared state lead to inconsistent or exploitable behavior. Covers database read-modify-write races, file system time-of-check-to-time-of-use (TOCTOU), double-spend attacks, counter increment without atomicity, missing database transactions, and concurrent request exploitation.

Activation

Called by sc-orchestrator during Phase 2. Runs against all applications with concurrent processing.

Phase 1: Discovery

Keyword Patterns to Search

"balance", "counter", "inventory", "stock", "quantity",
"increment", "decrement", "transfer", "withdraw",
"transaction", "BEGIN", "COMMIT", "ROLLBACK",
"Lock", "Mutex", "synchronized", "atomic",
"SELECT.*FOR UPDATE", "SERIALIZABLE"

Vulnerability Patterns

1. Database Read-Modify-Write Without Lock:

# VULNERABLE: Race condition on balance check
def withdraw(user_id, amount):
    user = User.objects.get(id=user_id)
    if user.balance >= amount:  # CHECK
        user.balance -= amount   # MODIFY
        user.save()              # WRITE
    # Two concurrent requests can both pass the check!

# SAFE: Atomic update with database-level lock
from django.db import transaction
from django.db.models import F

def withdraw(user_id, amount):
    with transaction.atomic():
        user = User.objects.select_for_update().get(id=user_id)
        if user.balance >= amount:
            user.balance = F('balance') - amount
            user.save()

2. Non-Atomic Counter:

// VULNERABLE: Counter increment without atomicity
app.post('/like/:postId', async (req, res) => {
  const post = await Post.findById(req.params.postId);
  post.likes += 1;  // Lost update under concurrent requests
  await post.save();
});

// SAFE: Atomic increment
app.post('/like/:postId', async (req, res) => {
  await Post.findByIdAndUpdate(req.params.postId, { $inc: { likes: 1 } });
});

3. File System TOCTOU:

// VULNERABLE: Check then use
if _, err := os.Stat(filepath); err == nil {  // CHECK
    data, _ := os.ReadFile(filepath)           // USE — file may have changed!
}

// SAFE: Just open and handle error
data, err := os.ReadFile(filepath)
if err != nil { /* handle */ }