bug(server): leaderboard opt-in check is not atomic — TOCTOU race condition #61

New Issue

2026-05-28T01:51:03Z

funman300 commented

2026-05-28 01:51:03 +00:00

Bug

In solitaire_server/src/sync.rs, the leaderboard submission path reads the user's opt-in flag and then writes the score in separate database operations. Between the read and the write, another request could change the opt-in status, leading to scores being submitted for users who have since opted out (or vice versa).

Affected file

solitaire_server/src/sync.rs

Fix

Wrap the opt-in check and score insert in a single SQL transaction:

BEGIN;
SELECT leaderboard_opt_in FROM users WHERE id = ? FOR UPDATE;
-- only INSERT if opt_in = true
INSERT INTO leaderboard_scores (...) SELECT ... WHERE opt_in = true;
COMMIT;

Or use a single conditional INSERT with a subquery that checks opt-in atomically.

## Bug In `solitaire_server/src/sync.rs`, the leaderboard submission path reads the user's opt-in flag and then writes the score in separate database operations. Between the read and the write, another request could change the opt-in status, leading to scores being submitted for users who have since opted out (or vice versa). ## Affected file `solitaire_server/src/sync.rs` ## Fix Wrap the opt-in check and score insert in a single SQL transaction: ```sql BEGIN; SELECT leaderboard_opt_in FROM users WHERE id = ? FOR UPDATE; -- only INSERT if opt_in = true INSERT INTO leaderboard_scores (...) SELECT ... WHERE opt_in = true; COMMIT; ``` Or use a single conditional INSERT with a subquery that checks opt-in atomically.

funman300 added the bug security server labels 2026-05-28 01:51:03 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: funman300/Ferrous-Solitaire#61