↓Skip to main content

TOCTOU

2026


Abusing TOCTOU Vulnerabilities in Financial Agents leading to double spending

·5 mins
I want to pay Fragment_A $1000 AND Fragment_B $1000, but I only have $1000. Double spending is a technique that will let me successfully do both concurrently before the banking or blockchain system validation tool catches the discrepancy. The exploit and result: TOCTOU Race Condition via Parallel Tool Calls # Step 1: Reconnaissance of the trading tools I queried the model about the difference between the create_order and execute_order tools to understand which of the two tools commits the transaction for money to leaves my account. I found out that create_order only creates an order and execute_order commits the orders using the order_ids, I created two orders - one for FRAGMENT_A and one for FRAGMENT_B - without any funds being deducted from my account: