Application Security When Milliseconds Move Money: Exploiting a Race Condition in a Financial Transfer Workflow
A researcher testing a banking app’s Pay Card feature found that identical payment requests sent in parallel could push a 2,000-unit source account to -8,000 units while crediting a card with 10,000 units. The validation worked on single requests but not under concurrency. This post walks through the test, the impact, and the fix.
