Race condition in faucet when using starport

Program: Cosmos Bug Type: Race condition Bounty: 5000 Date: 2022-06-26
race-condition

Summary

A race condition exists in Starport’s faucet implementation. The faucet is configured with a maximum token limit per user, but concurrent requests allow users to bypass this limit. In testing, Alice was able to receive 30 tokens despite the 11-token maximum. The root cause is the use of a Go map for tracking balances, which is unsafe for concurrent access. This summary was generated by AI

References