sc-race-condition

name	sc-race-condition
description	Race condition and TOCTOU detection — database races, file system races, double-spend, and atomicity failures
license	MIT
metadata	{"author":"ersinkoc","category":"security","version":"1.0.0"}

SC: Race Conditions / TOCTOU

Purpose

Detects race condition vulnerabilities where concurrent operations on shared state lead to inconsistent or exploitable behavior. Covers database read-modify-write races, file system time-of-check-to-time-of-use (TOCTOU), double-spend attacks, counter increment without atomicity, missing database transactions, and concurrent request exploitation.

Activation

Called by sc-orchestrator during Phase 2. Runs against all applications with concurrent processing.

Phase 1: Discovery

Keyword Patterns to Search

"balance", "counter", "inventory", "stock", "quantity",
"increment", "decrement", "transfer", "withdraw",
"transaction", "BEGIN", "COMMIT", "ROLLBACK",
"Lock", "Mutex", "synchronized", "atomic",
"SELECT.*FOR UPDATE", "SERIALIZABLE"

Vulnerability Patterns

1. Database Read-Modify-Write Without Lock:

# VULNERABLE: Race condition on balance check
def withdraw(user_id, amount):
    user = User.objects.get(id=user_id)
     user.balance >= amount:  
        user.balance -= amount   
        user.save()              
    


 django.db  transaction
 django.db.models  F

 ():
     transaction.atomic():
        user = User.objects.select_for_update().get(=user_id)
         user.balance >= amount:
            user.balance = F() - amount
            user.save()