Business logic and race conditions
7 guides tagged Business logic and race conditions, grouped by topic, with the SDLC phase and role each is written for.
Application security
6 guidesPreserve business invariants under concurrent requests
Make a balance, reservation or approval rule hold when requests overlap, retry and fail halfway through.
Design, Testing · Developers, AppSec engineers
Test smart contracts through state invariants
Define the properties funds and privileges must preserve, then exercise callbacks, transaction sequences and exceptional conditions locally.
Design, Development, Testing · Developers
Prevent business-logic flaws with server-side invariants
Recompute prices on the server, run workflows as state machines, build reset links from configuration, limit valuable flows, and turn each business rule into an invariant that the database and the tests both check.
Planning, Design, Testing · Developers, AppSec engineers
Abuse case library: tests and controls by feature
Recurring abuse cases for sign-up and login, password reset, MFA enrolment, invites, file upload, payments and coupons, webhooks, search, export, admin and AI chat or agents: the attacker goal, preconditions, a concrete test and the control, each linked to CWE and CAPEC.
Planning, Design, Testing · Developers, AppSec engineers
Create temporary files safely: mkstemp, O_EXCL and private directories
Stop symlink, hardlink and pre-created-file attacks on the temporary files your code writes in shared directories such as /tmp: create each file atomically with O_EXCL and owner-only permissions through mkstemp or its equivalent in shell, Python, Java, Node.js, Go, .NET and Rust, keep related files in a private directory, and treat the Linux protected_* sysctls and systemd PrivateTmp as a backstop.
Design, Development, Testing · Developers
DeFi attack patterns: oracles, flash loans, proxies and signatures
The four smart-contract attack classes beyond reentrancy: price-oracle manipulation, flash-loan amplification, upgradeable-proxy storage collisions and uninitialized implementations, and signature replay, each with vulnerable and fixed Solidity, Foundry tests and verified incidents.
Design, Development, Testing · Developers
Runtime, cloud & APIs
1 guidePractice
Race condition lab: Repair a balance check that races
Two simultaneous purchases both see the same balance and spend more credit than the account owns. Replace the read-then-write sequence with the supplied atomic debit.
Business logic lab: Price an order without trusting the client
A checkout trusts the price and quantity each cart line sends, adds every coupon code it recognizes, and never limits redemptions. Customers can choose their price, order negative quantities and stack discounts. Repair the pricing function so every amount comes from server data and every coupon rule holds.