Race condition in faucet when using starport
Program: Cosmos
Bug Type: Race condition
Bounty: 5000
Date: 2022-06-26
race-condition
Summary
A race condition exists in Starport’s faucet implementation. The faucet is configured with a maximum token limit per user, but concurrent requests allow users to bypass this limit. In testing, Alice was able to receive 30 tokens despite the 11-token maximum. The root cause is the use of a Go map for tracking balances, which is unsafe for concurrent access. This summary was generated by AI