Skip to content

v0.2.6 — fix invite-redeem double-spend race

Choose a tag to compare

View all tags
@adroidian adroidian released this 21 Sep 22:10
· 71 commits to main since this release
v0.2.6
5c52287
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixes the invite-redeem double-spend race found in v0.2.5 review.

  • Redeem now does an atomic conditional UPDATE ... WHERE revoked=0 AND exp>now AND uses<max_uses in the same transaction as the peer/token insert. Concurrent redeems of a single-use invite can no longer both win — the loser gets 410 invite_unusable and no credentials.
  • Mint quota check and insert now happen under one lock acquisition, closing the count-then-insert race.

Validated: 3x concurrent redeem harness -> [200,410] with uses=1, plus 36/36 relay regression passing.

Assets 2
Loading