A structure where 10 simultaneous requests all go through —
I'm publishing the code that stops it

// Vulnerable withdrawal API — modeled on the 2013 prepaid-card
// processor hack. The balance CHECK and the deduction ACT are two
// separate steps; the gap between them (a realistic DB round-trip)
// is a race window where concurrent requests all see the balance
// from BEFORE any of them has written back.
class RaceConditionWithdrawal {
  constructor(account) {
    this.account = account; // { balance }
  }

  async withdraw(amount) {
    const current = this.account.balance; // CHECK
    await simulatedDbRoundTrip(); // the race window
    if (current < amount) return { status: 'insufficient_funds' };
    this.account.balance = current - amount; // ACT — based on a stale read
    return { status: 'ok', newBalance: this.account.balance };
  }
}

module.exports = { RaceConditionWithdrawal };

// The fix: no other request can act between the check and the
// deduction — an account-level lock makes both one atomic step.
// (A real system would use a DB row lock or an atomic
// UPDATE ... WHERE balance >= amount.)
class AtomicWithdrawalGuard {
  constructor(account) {
    this.account = account;
    this.locked = false;
  }

  async withdraw(amount) {
    while (this.locked) await sleep(5);
    this.locked = true;
    try {
      await simulatedDbRoundTrip(); // same delay, now INSIDE the lock
      if (this.account.balance < amount) return { status: 'insufficient_funds' };
      this.account.balance -= amount;
      return { status: 'ok', newBalance: this.account.balance };
    } finally {
      this.locked = false;
    }
  }
}

module.exports = { AtomicWithdrawalGuard };