Reward that pays twice
Claim once, get 50. Claim again, politely refused. Double-tap fast and you walk away with 100. The 'once a day' rule has a blind spot.
nodeChewy~25 min
1
Fresh from the oven
Clone it down and have a look around.
$
git clone https://github.com/loaf-crumbs/reward-that-pays-twice.git2
The scenario
A loyalty page lets a baker claim 50 free crumbs once per day. The server guards it: when you claim, it checks whether you've already claimed today, and if you have, it refuses with "already claimed today." Click the button, your balance jumps by 50. Click it again a moment later and you get the refusal, exactly as intended.
The guard holds up under calm, deliberate clicking. It falls apart under enthusiasm. Double-tap the Claim button — two clicks in quick succession, the second before the first has finished — and both go through. Your balance climbs by 100 from a single day's reward. Reset to a fresh day and you can do it again every time, as long as the two clicks are close enough together.
Nothing errors. The "already claimed" message still works when the clicks are spaced out. It's the overlap that beats the check. Make the daily reward pay out exactly once per day, no matter how fast or how many times the button is pressed.
3
What done looks like
- A day's reward credits the balance by exactly 50, even under rapid double-clicks
- Many truly-parallel claim requests (e.g. 5 fired at once via curl) result in one success and the rest refused — total credited is still exactly 50
- The fix holds regardless of the handler's timing: shrinking or removing the artificial delay is not a fix
- A deliberate second claim still returns "already claimed today"
- Resetting the day and claiming once still works normally
4
Stuck?
Peek if you need to — they get more specific as you go.
5
Taste test
Send it in when you’re ready. We’ll see if it’s tasty.
When you've got the flag, paste it here.
No attempts yet.