TOCTOU in Payment Systems: When Validation Becomes Stale Before Commit
The formal problem: CWE-367 Time-of-check to time-of-use (TOCTOU) is a formally catalogued class of race condition, CWE-367 , first documented in 2006 and still actively relevant two decades later. The pattern: a program evaluates a precondition, then acts on a resource whose state it assumes is unchanged, without any atomicity guarantee between the two operations. The canonical C example: //…
CWE-367, Time-of-check to time-of-use race condition, has been active for two decades since its formal documentation in 2006. This occurs when a program checks a resource's state, then uses it, without ensuring the state remains unchanged in between. A classic example in C involves checking if a file is readable, then attempting to open it.
However, an attacker could overwrite the file during this window, changing its state before the program actually opens it. The same pattern exists in Python and other languages. The solution is to combine the check and use into a single atomic operation. Recent high-severity examples include CVE-2019-5736 and CVE-2016-9806. Distributed systems literature has been studying a related concept, commitment ordering, since 1990.
This principle ensures the chronological order of transactions committing matches the order of their conflicting operations, providing a framework for reasoning about ordering in systems with multiple autonomous resource managers.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
